HackGit

​​DEFCON-CICD-pipelines-workshop In this fully hands-on workshop, we’ll guide you through multiple vulnerabilities that we witnessed during numerous penetration tests. You’ll learn how to: ▫️ Get a foothold within a CI/CD pipeline ▫️ Find interesting secrets and other information within code repositories ▫️ How to pivot and exploit weak configuration on the orchestrator ▫️ Compromise building nodes in order to add backdoors to artifacts ▫️ Pivot on cloud infrastructure ▫️ Escape kubernetes thanks to common misconfiguration ▫️ Perform a privilege escalation in AWS https://github.com/wavestone-cdt/DEFCON-CICD-pipelines-workshop

​​Chameleon Tiny Pro World's smallest portable RFID emulation multi-tool. Emulate multiple tags and tag types, sniff, crack and infiltrate with this keyring sized device. Emulating, storing and manipulating RFID tags is a vital part of any pentesting assignment. The ChameleonTiny is an RFID Emulation Device, capable of simulating multiple types of RFID Tag Formats in one device. Proxgrind's ChameleonTiny is based on the RevG Framework, but optimised for size and portability. Features: ▫️ Multiple Chipset Emulation ▫️ Read / Emulate Operations ▫️ MFKey32 Crack Support ▫️ UID Sniff ▫️ UID Fuzzing / Manipulation ▫️ Read / Write Lock ▫️ Advanced Sniffing & Logging ▫️ Open-Source Repository: https://github.com/emsec/ChameleonMini https://github.com/iceman1001/ChameleonMini-rebootedGUI Buy online: 🛒 https://ali.ski/m59bL #rfid

​​HackTheBox CTF Cheatsheet This cheatsheet is aimed at CTF players and beginners to help them sort Hack The Box Labs on the basis of operating system and difficulty. This list contains all the Hack The Box writeups available on hackingarticles. We have performed and compiled this list based on our experience. Please share this with your connections and direct queries and feedback to Hacking Articles. https://github.com/Ignitetechnologies/HackTheBox-CTF-Writeups

​​Parani-UD100-G03 The Sena Parani-UD100 is a class 1 type Bluetooth USB adapter that supports 300 meters of wireless transmission distance by default. The working distance can be further extended up to 1000 meters using an optional replacement antenna. Thanks to its longer communication distance than other regular Bluetooth USB adapters, it is suitable for industrial or special applications. Parani-UD100 is compatible with various Sena Bluetooth devices. ▫️ Bluetooth 4.0, USB 2.0, supports up to 7 simultaneous connections ▫️ Supports Bluetooth DUN, FAX, SPP, HID, FTP, OPP, SDP, HCRP, LAN, OBEX FTP, OBEX OPP, OBEX BIP, BIP, AVRCP, A2DP, HSP, HFP, PAN, BPP, Headset, AVCTP, AVDTP, HDP, Find Me, Proximity, Health Thermometer, Heart Rate, HID OVER GATT profiles ▫️ Easy to use Windows configuration tool available ▫️ Bluetooth driver needed (Bluesoleil driver) ▫️ Working distance (In an open field): Normally 300 meters, up to 600 meters using 5 dipole antenna bluescan - Bluetooth scanner for hacking: https://github.com/fO-000/bluescan Buy online: 🛒 https://amzn.to/3sn2qfE #bluetooth

​​FlowDroid Data Flow Analysis Tool This repository hosts the FlowDroid data flow analysis tool. FlowDroid statically computes data flows in Android apps and Java programs. Its goal is to provide researchers and practitioners with a tool and library on which they can base their own research projects and product implementations. We are happy to see that FlowDroid is now widely used in academia as well as industry. https://github.com/secure-software-engineering/FlowDroid

​​Bug-Bounty-Wordlists A repository that includes all the important wordlists used while bug hunting. Wordlists will be updated regularly https://github.com/YaS5in3/Bug-Bounty-Wordlists t.me/hackgit

​​Synch0le This tool is for exploring HTTP De-Sync attacks using the CL.0 methods detailed by James Kettle in his research "Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling" published at Defcon and Blackhat. Synch0le will take a URL, or a file with a list of URLS, and probe each of them to determine: ▫️ If the server supports HTTP/2 ▫️ If the server validates Content-Length on an incoming POST request to an unexpected endpoint (favicon.ico) ▫️ If a successful De-Sync can be achieved by sending two requests across the same connection https://github.com/jsharp6968/synch0le Details: https://sharpsec.run/?p=127

incidentrepsonse Reset every AD account except the running account and export the usernames and passwords to a file! https://github.com/mr-r3b00t/incidentrepsonse

​​getsymbol Tool to download debugging symbols from Microsoft, Google, Mozilla and Citrix symbol servers for reverse engineers compatible with Windows 8.1/10/11 https://github.com/dbgsymbol/getsymbol

​​UFONet UFONet - is a free software, P2P and cryptographic -disruptive toolkit- that allows to perform DoS and DDoS attacks; on the Layer 7 (APP/HTTP) through the exploitation of Open Redirect vectors on third-party websites to act as a botnet and on the Layer3 (Network) abusing the protocol. It also works as an encrypted DarkNET to publish and receive content by creating a global client/server network based on a direct-connect P2P architecture. https://github.com/epsylon/ufonet

​​cypherhound A Python3 terminal application that contains 190+ Neo4j cyphers for BloodHound data sets. https://github.com/fin3ss3g0d/cypherhound

​​SMBSR Lookup For Interesting Stuff In SMB Shares. Python script which given a CIDR/IP/IP_file/HOSTNAME(s) enumerates all the SMB services listening (445) among the targets and tries to authenticate against them; if the authentication succeed then all the folders and subfolders are visited recursively in order to find secrets in files and ... secret files. In order to scan the targets for SMB ports open the masscan module is used. SMBSR consides someting interesting basing on its: ▫️ Content ▫️ Exstension ▫️ Name https://github.com/oldboy21/SMBSR #Donate t.me/hackgit🍻»»»

​​ScreenshotBOF An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot saved to disk as a file. https://github.com/CodeXTF2/ScreenshotBOF #Donate t.me/hackgit🍻»»»

​​sn0int sn0int (pronounced /snoɪnt/) is a semi-automatic OSINT framework and package manager. It's used by IT security professionals, bug bounty hunters, law enforcement agencies and in security awareness trainings to gather intelligence about a given target or about yourself. sn0int is enumerating attack surface by semi-automatically processing public information and mapping the results in a unified format for followup investigations. Among other things, sn0int is currently able to: ▫️ Harvest subdomains from certificate transparency logs and passive dns ▫️ Mass resolve collected subdomains and scan for http or https services ▫️ Enrich ip addresses with asn and geoip info ▫️ Harvest emails from pgp keyservers and whois ▫️ Discover compromised logins in breaches ▫️ Find somebody's profiles across the internet ▫️ Enumerate local networks with unique techniques like passive arp ▫️ Gather information about phonenumbers ▫️ Harvest activity and images from social media profiles ▫️ Basic image processing https://github.com/kpcyrd/sn0int #OSINT

​​bluescan A Bluetooth scanner for hacking Bluetooth is a complex protocol, and a good scanner can quickly help us peek inside its secrets. But previous Bluetooth scanners suffered from a number of problems such as incomplete functionality, unintuitive information and out of repair. So we came up with this powerful Bluetooth scanner based on modern Python3. When hacking Bluetooth targets, bluescan can be very useful for intelligence collecting. It can collect the following information: ▫️ BR devices ▫️ LE devices ▫️ BR LMP features ▫️ LE LL features ▫️ SMP Pairing features ▫️ Real-time advertising physical channel PDU ▫️ SDP services ▫️ GATT services ▫️ Vulnerabilities (deprecated and will be presented in another way) The recommended USB Bluetooth adapter is Parani UD100-G03. https://github.com/fO-000/bluescan

​​osquery-defense-kit Production-ready detection & response queries for osquery ODK (osquery-defense-kit) is unique in that the queries are designed to be used as part of a production detection & response pipeline. The detection queries are formulated to return zero rows during normal expected behavior, so that they may be configured to generate alerts when rows are returned. At the moment, these queries are predominantly designed for execution on POSIX platforms (Linux & macOS). Pull requests to improve support on other platforms are fully welcome. https://github.com/chainguard-dev/osquery-defense-kit

​​fuzz4bounty Awesome wordlists for Bug Bounty Hunting This repository contains publicly available wordlists for Bug hunting. The main Objective for creating this repo is to bring all the available worlists at one place. https://github.com/0xlittleboy/fuzz4bounty

​​CVE-2022-21970 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This vulnerability allows an attacker to execute javascript code on every host without permission, also an attacker can steal local system files, and also he can manipulate the actions against the machine and result in changing internal developer settings in Microsoft Edge. https://github.com/Malwareman007/CVE-2022-21970

​​PatchThatAMSI 6 AMSI patches , both force the triggering of a conditional jump inside AmsiOpenSession() that close the Amsi scanning session. The 1st patch by corrupting the Amsi context header and the 2nd patch by changing the string "AMSI" that will be compared to the Amsi context header to "D1RK". The other just https://github.com/D1rkMtr/PatchThatAMSI #amsi #av #bypass

​​SandboxProfiler Collect information of internet-connected sandboxes, no backend needed. This is achieved using telegram and interact.sh to collect data, however custom listeners are also supported. Non internet-connected sandboxes are not in scope, however it is possible to check for DNS exfiltration. https://gitlab.com/brn1337/sandboxprofiler