HackGit

​​Inventory Asset Inventory of public bug bounty programs. The data we collect here includes subdomains, URLs, web servers, cloud assets, and a lot more data on public bug bounty programs. Our aim with this project is to: ▫️ help bug bounty hunters get up and running on new programs as quickly as possible. ▫️ give security teams better visibility into their assets. ▫️ reduce the load and noise that some programs face from automated tools (we run them on schedule, give the results to everyone) https://github.com/trickest/inventory

​​ReshaperForBurp #Burp Suite Extension - Trigger actions and reshape HTTP request and response traffic using configurable rules. ▫️ Event Direction - If the HTTP message is a Request or Response ▫️ Has Entity - If the HTTP event contains a certain entity ▫️ Matches Text - If a value (text, variable, or HTTP event entity) matches a value ▫️ Proxy Name - If received by a certain Burp proxy listener ▫️ From Tool - If the HTTP message is from a specific Burp tool https://github.com/synfron/ReshaperForBurp

llvm_deobuscator This project for use llvm optimisation (and retdec) for code recompilation. The project is extremely raw, nothing more than PoC https://github.com/bilka00/llvm_deobuscator

​​Raspberry Pi 4 Model B - Miniature Hacking Station! Raspberry Pi 4 Model B was released with specs including either 1 GB, 2 GB, 4 GB, or 8 GB of memory, a Broadcom BCM2711B0 quad-core A72 SoC, a USB Type-C power supply, and dual Micro-HDMI outputs. Performance and hardware changes aside, the Pi 4 Model B runs Kali Linux just as well, if not better, than its predecessors. It also includes support for Wi-Fi hacking on its internal wireless card. For hackers interested in a cheap Kali Linux computer capable of hacking Wi-Fi without a separate wireless network adapter, the Pi 4 Model B is a great way to run Kali without needing a virtual machine. Thanks to the number of Wi-Fi hacking tools included in Kali Linux, the new Pi 4 Model B represents a complete Ethernet and Wi-Fi hacking kit for beginners. The reasons for using a Raspberry Pi as a hacking computer are many. Previous Raspberry Pi versions have proved that it doesn't take expensive hardware to run tools in Kali Linux. Virtual machines can behave unpredictably, especially when working with Wi-Fi hacking. Plus, it's sometimes more straightforward to run Kali on hardware rather than in a virtual machine. Another advantage to the Raspberry Pi is that it can easily be used in combination with a device like an unmodified iPhone or Android smartphone. If your smartphone supports creating a Wi-Fi hotspot, it's simple to connect the Pi to your hotspot and control it over SSH. If your smartphone can't create a hotspot, the Pi can also host its own Wi-Fi network, allowing you to join the network created by the Pi on your phone and SSH into it on the go. One of the most exciting things about using a Raspberry Pi for hacking is the add-on of the Nexmon firmware. The addition makes it possible to put the built-in Wi-Fi network adapter into monitor mode. That means it's possible to do things like grab WPA handshakes, listen in on Wi-Fi traffic, and execute attacks like WPS-Pixie without needing a separate compatible Wi-Fi network adapter. For someone interested in getting started with Wi-Fi hacking, the Raspberry Pi 4 Model B provides a Kali-supported Wi-Fi network adapter and an onboard computer capable of basic cracking and MiTM attacks in a single package. The increase in speed and power of the Pi 4 Model B make it a more capable networking device as well as a more capable computer. Hack WiFi with a Raspberry Pi and Kali Linux: https://www.youtube.com/watch?v=PqRVo2niA_8 Buy online: 🛒 https://ali.ski/QMVRo #raspberrypi #mobilepc #kali

vbackdoor Hide process, port, self under Linux using the LD_PRELOAD rootkit. https://github.com/veo/vbackdoor

BloodHound BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory or Azure environment. Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify. Defenders can use BloodHound to identify and eliminate those same attack paths. Both blue and red teams can use BloodHound to easily gain a deeper understanding of privilege relationships in an Active Directory or Azure environment. https://github.com/BloodHoundAD/BloodHound Introducing BloodHound 4.2 — The Azure Refactor: https://posts.specterops.io/1cff734938bd Active Directory Enumeration: BloodHound: https://www.hackingarticles.in/active-directory-enumeration-bloodhound/ #redteam #ad

​​ADenum ADEnum.py is a pentesting tool that allows to find misconfiguration through the protocol LDAP and exploit some of those weaknesses with Kerberos. LDAP: ▫️ Enum Domain Admin users ▫️ Enum Domain Controllers ▫️ Enum Domain users with Password Not Expire ▫️ Enum Domain users with old password ▫️ Enum Domain users with interesting description ▫️ Enum Domain users with not the default encryption ▫️ Enum Domain users with Protecting Privileged Domain Accounts Kerberos: ▫️ AS-REP Roastable ▫️ Kerberoastable ▫️ Password cracking with john (krb5tgs and krb5asrep) https://github.com/SecuProject/ADenum #ad #redteam

​​Certipy Certipy is an offensive tool for enumerating and abusing Active Directory Certificate Services (AD CS). If you're not familiar with AD CS and the various domain escalation techniques, I highly recommend reading Certified Pre-Owned by Will Schroeder and Lee Christensen. https://github.com/ly4k/Certipy Certipy 4.0: ESC9 & ESC10, BloodHound GUI, New Authentication and Request Methods — and more!: https://research.ifcr.dk/7237d88061f7 #redteam #ad

​​PersistenceSniper Powershell script that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. The script is also available on Powershell Gallery. https://github.com/last-byte/PersistenceSniper #blueteam

​​shelljack Computer surveillance tool designed to capture Linux command-line interactions in real-time. This is the term I use to describe a pseudo-terminal mitm attack. This technique embeds the attacker between the target user and their shell. From this position the attacker is able to inspect and capture all I/O as it crosses the terminal. This is similar to a keystroke logger, but will also return the output from the command line as well. In addition to the data being captured, it is also forwarded to a remote listener for analysis in real time. https://github.com/emptymonkey/shelljack

​​CVE-2022-34918 LPE POC https://github.com/veritas501/CVE-2022-34918 #cve #poc

​​Deepware Scanner (CLI) This repository contains the command-line deepfake scanner tool with the pre-trained models that are currently used at deepware.ai. To get an in-depth review about the scanner and the training process please refer to deepware.md. https://github.com/deepware/deepfake-scanner

​​Kage Kage (ka-geh) is a tool inspired by AhMyth designed for Metasploit RPC Server to interact with meterpreter sessions and generate payloads. https://github.com/Zerx0r/Kage

​​Honggfuzz A security oriented, feedback-driven, evolutionary, easy-to-use fuzzer with interesting analysis options. https://github.com/google/honggfuzz

​​AllHackingTools A system designed to automate the download process and install various tools for penetration testing. https://github.com/mishakorzik/AllHackingTools

​​Raspberry Pi Zero W (Wireless) This is the smallest Raspberry Pi. The board is just half the size of a Raspberry Pi Model A+, but with more capabilities! The Raspberry Pi Zero W features wireless connectivity providing onboard Bluetooth 4.1, BLE and WiFi! The board itself is just 65mm x 30mm x 5mm in size, is has a mini camera connector, a microSD slot, mini HDMI, 2x microUSB (one for USB and one for Power). Just like the A+ and the B+, the Pi Zero W features a single core CPU clocked at 1GHz and 512MB RAM. The GPIO header is unpopulated so you can choose wether you want to solder a header on or not. This gives you a lot of freedom how the Raspberry Pi Zero W can be used. You can very easily install Kali Linux on it and start doing security testing. Raspberry Pi Zero W WiFi Hacking Gadget: https://thesmashy.medium.com/63e3fa1c3c8d Buy online: 🛒 https://ali.ski/85vjVr #raspberrypi #zero #kali

​​evilginx2 A man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection. This tool is a successor to Evilginx, released in 2017, which used a custom version of nginx HTTP server to provide man-in-the-middle functionality to act as a proxy between a browser and phished website. Present version is fully written in GO as a standalone application, which implements its own HTTP and DNS server, making it extremely easy to set up and use. https://github.com/kgretzky/evilginx2

​​checkmk.py Check if a PAN firewall is using the default master key when globalprotect is enabled https://gist.github.com/rqu1/6175cb2972291fc9ac96ef18f72b792c