HackGit
Open in Telegram
The channel was created for cybersecurity specialists. • Offensive Security • RedTeam • Malware Research • BugBounty • OSINT • etc Disclaimer: t.me/hackgit/2082 Donations - Ads: t.me/hackgit/5423
Show more📈 Analytical overview of Telegram channel HackGit
Channel HackGit (@hackgit) in the English language segment is an active participant. Currently, the community unites 21 579 subscribers, ranking 4 526 in the Technologies & Applications category and 1 853 in the USA region.
📊 Audience metrics and dynamics
Since its creation on невідомо, the project has demonstrated rapid growth, gathering an audience of 21 579 subscribers.
According to the latest data from 02 March, 2025, the channel demonstrates stable activity. Although there has been a change in the number of participants by 19 over the last 30 days and by 0 over the last 24 hours, overall reach remains high.
- Verification status: Not verified
- Engagement rate (ER): The average audience engagement rate is 0%. Within the first 24 hours after publication, content typically collects N/A% reactions from the total number of subscribers.
- Post reach: On average, each post receives 0 views. Within the first day, a publication typically gains 0 views.
- Reactions and interaction: The audience actively supports content: the average number of reactions per post is 0.
📝 Description and content policy
The author describes the resource as a platform for expressing subjective opinions:
“The channel was created for cybersecurity specialists.
• Offensive Security
• RedTeam
• Malware Research
• BugBounty
• OSINT
• etc
Disclaimer:
t.me/hackgit/2082
Donations - Ads:
t.me/hackgit/5423”
Thanks to the high frequency of updates (latest data received on 11 November, 2026), the channel maintains relevance and a high level of publication reach. Analytics show that the audience actively interacts with content, making it an important point of influence in the Technologies & Applications category.
21 579
Subscribers
No data24 hours
-37 days
+1930 days
Posts Archive
21 579
Repost from Pentesting Shop
Wardriving
The antenna is suitable for remote wifi network penetration testing.
Wi-Fi Yagi antenna is designed to increase the Wi-Fi transmission distance. With the 29° narrow beamwidth and 14dBi high gain, the Wi-Fi Yagi antenna provides you the maximized Wi-Fi transmission performance, especially for long-distance coverage applications.
The Wi-Fi yagi antenna can also connect to a modem receive to enhance the Wi-Fi signal reception. Made by aluminum radiation elements with traditional structure, it brings you the most durable working performance in the rugged outdoor environments.
Buy online:
🛒 https://ali.ski/2-b6_2
#wifi #antenna
21 579
Koh: The Token Stealer
Koh is a C# and and Beacon Object File (BOF) toolset that allows for the capture of user credential material via purposeful token/logon session leakage.
https://github.com/GhostPack/Koh
Research:
https://posts.specterops.io/koh-the-token-stealer-41ca07a40ed6
#logon #token #session #impersonate
21 579
route-sixty-sink
Route Sixty-Sink is an open source tool that enables defenders and security researchers alike to quickly identify vulnerabilities in any .NET assembly using automated source-to-sink analysis.
Identifying vulnerabilities within application binaries or source code is often a long and tedious process. To help with this, source-to-sink analysis is a form of data flow analysis that attempts to identify user input that is passed as the argument of a dangerous function call (a “sink”).
By enumerating a list of sinks, identifying them within an application, and backtracking them to user-controlled input, source-to-sink analysis can identify high fidelity vulnerabilities.
https://github.com/mandiant/route-sixty-sink
Research:
https://www.mandiant.com/resources/route-sixty-sink-launch
21 579
TargetAllDomainObjects
A python wrapper to run a command on against all users/computers/DCs of a Windows Domain
Features:
▫️ Only requires a low privileges domain user account.
▫️ Automatically gets the list of all users/computers/DCs from the domain controller's LDAP.
▫️ Multithreaded command execution.
▫️ Saves the output of the commands to a file.
https://github.com/p0dalirius/TargetAllDomainObjects
21 579
Slient-Doc-Pdf-Exploit-Builder-Fud-Malware-Cve
Vulnerability Disclosure Timeline Closer inspection of the Exploit PDF content reveals the malicious link as well as the URL Download and Execute of the tool used to generate the Exploit PDF from Python encrypted code content which we also implement in couple of our builders.
https://github.com/AZMagic/Slient-Doc-Pdf-Exploit-Builder-Fud-Malware-Cve
21 579
fingerprint-suite
fingerprint-suite is a handcrafted assembly of tools for browser fingerprint generation and injection. Today's websites are increasingly using fingerprinting to track users and identify them.
With the help of fingerprint-suite you can generate and inject browser fingerprints into your browser, allowing you to fly your scrapers under the radar.
View full documentation, guides and examples on the fingerprint-suite website
https://github.com/apify/fingerprint-suite
21 579
Repost from Pentesting News
Redsheet
Red Teaming & Active Directory Cheat Sheet
https://github.com/expl0itabl3/Redsheet
21 579
Coercer
A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods.
▫️ Automatically detects open SMB pipes on the remote machine.
▫️ Calls one by one all the vulnerable RPC functions to coerce the server to authenticate on an arbitrary machine.
▫️ Analyze mode with --analyze, which only lists the vulnerable protocols and functions listening, without performing a coerced authentication.
▫️ Perform coerce attack on a list of targets from a file with --targets-file
https://github.com/p0dalirius/Coercer
21 579
windows-coerced-authentication-methods
This repository contains a list of many methods to coerce a windows machine to authenticate to an attacker-controlled machine.
All of these methods are callable by a standard user in the domain to force the machine account of the target Windows machine (usually a domain controller) to authenticate to an arbitrary target. The root cause of this "vulnerability/feature" in each of these methods is that Windows machines automatically authenticate to other machines when trying to access UNC paths (like \192.168.2.1\SYSVOL\file.txt).
There is currently 15 known methods in 5 protocols.
https://github.com/p0dalirius/windows-coerced-authentication-methods
21 579
SecretFlow
Unified framework for privacy-preserving data intelligence and machine learning. To achieve this goal, it provides:
▫️ An abstract device layer consists of plain devices and secret devices which encapsulate various cryptographic protocols.
▫️ A device flow layer modeling higher algorithms as device object flow and DAG.
▫️ An algorithm layer to do data analysis and machine learning with horizontal or vertical partitioned data.
▫️ A workflow layer that seamlessly integrates data processing, model training, and hyperparameter tuning.
https://github.com/secretflow/secretflow
21 579
defiHacks_via_Hardhat
Fork and then simulate popular smart contract exploits on various DEFI Protocols using Hardhat Framework.
https://github.com/zzzuhaibmohd/defiHacks_via_Hardhat
21 579
WMIHACKER（No need 445 Port）
Bypass anti-virus software lateral movement command execution test tool（No need 445 Port）
Introduction: The common WMIEXEC, PSEXEC tool execution command is to create a service or call Win32_Process.create, these methods have been intercepted by Anti-virus software 100%, so we created WMIHACKER (Bypass anti-virus software lateral movement command execution test tool（No need 445 Port）).
Main functions: 1. Command execution; 2. File upload; 3. File download
https://github.com/rootclay/WMIHACKER
21 579
GadgetToJScript
A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA scripts.
The current gadget triggers a call to Activator.CreateInstance() when deserialized using BinaryFormatter from jscript/vbscript/vba, this means it can be used to trigger execution of your .NET assembly of choice via the default/public constructor.
The tool was created mainly for automating WSH scripts weaponization for RT engagements (Initial Access, Lateral Movement, Persistence), the shellcode loader which was used for PoC is removed and replaced by an example assembly implemented in the TestAssembly project.
https://github.com/med0x2e/GadgetToJScript
21 579
Awesome-web3-Security
A curated list of web3 Security materials and resources For Pentesters and Bug Hunters.
https://github.com/Anugrahsr/Awesome-web3-Security
21 579
CrackQL
A GraphQL password brute-force and fuzzing utility.
CrackQL is a versatile GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations.
https://github.com/nicholasaleks/CrackQL
21 579
CVE-2022-34265
PoC verification of Django vulnerability
A vulnerability (CVE-2022-34265) in Django was disclosed on July 5, 2022 (US time). This article describes our discussion of this vulnerability and the results of our verification.
https://github.com/aeyesec/CVE-2022-34265
#cve #poc
21 579
Repost from Pentesting News
thgtoa
This is a maintained guide with the aim of providing an introduction to various online tracking techniques, online ID verification techniques, and detailed guidance to creating and maintaining (truly) anonymous online identities.
It is written with hope for activists, journalists, scientists, lawyers, whistle-blowers, and good people being oppressed, censored, harassed anywhere!
https://github.com/Anon-Planet/thgtoa
21 579
Security Bugs
Full disclosures for CVE ids, proofs of concept, exploits, 0day bugs and so on. Microsoft Internet Explorer 11 (protected mode off) & Adobe Acrobat Reader DC ActiveX
https://github.com/j00sean/SecBugs
#cve #0day
21 579
Papaya
#NoSQL Injection Tool to bypass login forms & extract usernames/passwords using regular expressions.
Papaya is a tool to test if a #MongoDB/NoSQL-based web application is vulnerable to a basic NoSQL injection on POST login forms, including tests for password and username extraction.
https://github.com/eversinc33/Papaya
