HackGit
Открыть в Telegram
The channel was created for cybersecurity specialists. • Offensive Security • RedTeam • Malware Research • BugBounty • OSINT • etc Disclaimer: t.me/hackgit/2082 Donations - Ads: t.me/hackgit/5423
Больше📈 Аналитический обзор Telegram-канала HackGit
Канал HackGit (@hackgit) языкового сегмента Английский является активным участником. Сейчас сообщество объединяет 21 579 подписчиков, занимая 4 526 место в категории Технологии и приложения и 1 853 место в регионе США.
📊 Показатели аудитории и динамика
С момента создания невідомо проект демонстрирует стремительный рост, собрав аудиторию из 21 579 подписчиков.
Согласно последним данным от 02 марта, 2025, канал показывает стабильную активность. За последние 30 дней изменение числа участников составило 19, а за последние 24 часа — 0, при этом общий охват остаётся высоким.
- Статус верификации: Не верифицирован
- Уровень вовлечённости (ER): Средний показатель вовлечённости аудитории составляет 0%. В первые 24 часа после публикации контент обычно набирает N/A% реакций от общего числа подписчиков.
- Охват публикаций: В среднем каждый пост получает 0 просмотров. В течение первых суток публикация набирает 0 просмотров.
- Реакции и взаимодействия: Аудитория активно поддерживает контент: среднее количество реакций на один пост — 0.
📝 Описание и контентная политика
Автор описывает ресурс как площадку для выражения субъективного мнения:
“The channel was created for cybersecurity specialists.
• Offensive Security
• RedTeam
• Malware Research
• BugBounty
• OSINT
• etc
Disclaimer:
t.me/hackgit/2082
Donations - Ads:
t.me/hackgit/5423”
Благодаря высокой частоте обновлений (последние данные получены 11 ноября, 2026) канал поддерживает актуальность и высокий уровень охвата публикаций. Аналитика показывает, что аудитория активно взаимодействует с контентом, что делает его важной точкой влияния в категории Технологии и приложения.
21 579
Подписчики
Нет данных24 часа
-37 дней
+1930 дней
Архив постов
21 579
Darkdump
Search The Deep Web Straight From Your Terminal
Darkdump is a simple script written in Python3.9 in which it allows users to enter a search term (query) in the command line and darkdump will pull all the deep web sites relating to that query. Darkdump wraps up the darksearch.io API - Note that darksearch.io now forbids public queries so I will be changing the new API as soon as possible.
https://github.com/josh0xA/darkdump
@HackGit
21 579
Fzshell
Fuzzy shell completions you didn't know you needed.
Fuzzy command line completer that fetches completions from sources predefined by a user. What does it mean? It means that now you can create custom completions for anything you want. All fzshell needs is a pattern to match and command to generate completion list. It can even insert a completion at any point in a line, not just at the end. See for yourself:
https://github.com/mnowotnik/fzshell
@HackGit
21 579
APIClarity
Reconstruct Open #API Specifications from real-time workload traffic seamlessly.
Microservices API challenges:
▫️ Not all applications have an OpenAPI specification available
▫️ How can we get this for legacy or external applications?
▫️ Detect whether microservices still use deprecated APIs (a.k.a. Zombie APIs)
▫️ Detect whether microservices use undocumented APIs (a.k.a. Shadow APIs)
▫️ Generate OpenAPI specifications without code instrumentation or modifying existing workloads (seamless documentation)
Solution:
▫️ Capture all API traffic in an existing environment using multiple traffic sources
▫️ Construct an OpenAPI specification by observing API traffic or upload a reference OpenAPI spec
▫️ Review, modify and approve automatically generated OpenAPI specs
▫️ Alert on any differences between the approved API specification and the API calls observed at runtime; detects shadow & zombie APIs
▫️ UI dashboard to audit and monitor the findings
https://github.com/openclarity/apiclarity
@HackGit
21 579
OpenAPI fuzzer
Black-box fuzzer that fuzzes APIs based on OpenAPI specification. All you need to do is to supply URL of the API and its specification. Find bugs for free!
https://github.com/matusf/openapi-fuzzer
@HackGit
21 579
brutas
Wordlists and passwords handcrafted with ♥️
A pretty comprehensive set of password dictionaries and wordlists designed for quick wins in red teaming scenarios or general blackbox pentesting.
https://github.com/tasooshi/brutas
@HackGit
21 579
Recon Hunter
A tool to map the attack surface discovery of any target.
Features:
▫️ Sub-Domains Passive Scraping
▫️ Sub-Domains Brute Force
▫️ Sub-Domains Wildcard Removal
▫️ Sub-Domains Spidering
▫️ Sub-Domains Takeover
▫️ IPs Enumeration using Censys
▫️ Port Scanning
▫️ Websites' Screenshots
▫️ Directories & Files Brute Force
▫️ Internet Archive
▫️ AWS S3 Buckets
▫️ Github Leaked Secrets
https://github.com/hassan0x/ReconHunter
@HackGit
21 579
Mangle
Mangle is a tool that manipulates aspects of compiled executables (.exe or DLL). Mangle can remove known Indicators of Compromise (IoC) based strings and replace them with random characters, change the file by inflating the size to avoid EDRs, and can clone code-signing certs from legitimate files. In doing so, Mangle helps loaders evade on-disk and in-memory scanners.
https://github.com/optiv/Mangle
#av #edr #memory #evasion #redteam
21 579
Schemathesis
Schemathesis is a modern API testing tool for web applications built with Open API and GraphQL specifications.
It reads the application schema and generates test cases, which will ensure that your application is compliant with its schema (read more about how it works in our research paper).
The application under test could be written in any language; the only thing you need is a valid API schema in a supported format.
Simple to use and yet powerful to uncover hard-to-find errors thanks to the property-based testing approach backed by state-of-the-art Hypothesis library.
Features:
▫️ Open API: Schema conformance, explicit examples, stateful testing;
▫️ GraphQL: queries generation;
▫️ Multi-worker test execution;
▫️ Storing and replaying tests;
▫️ ASGI / WSGI support;
▫️ Generated code samples (cURL, Python);
▫️ Docker image;
▫️ Customizable checks & test generation
https://github.com/schemathesis/schemathesis
@HackGit
21 579
ElevatedEvents
EventViewer UAC bypass via .NET Deserialization discovered by @OrangeTsai made into a Reflective DLL to use with Cobalt Strike.
Supports direct execution of executables, and doesn't rely on spawning cmd.exe through mmc.exe as shown in the original POC. However due to this command agruements are not supported.
As this UAC bypass is currently detected by Defender, a simple bypass is utilized that renames the file back to the original after its created to avoid detection.
https://github.com/jsecu/ElevatedEvents
@HackGit
21 579
Remote Exploitation Technique For CVE 2022-31626
https://github.com/CFandR-github/PHP-binary-bugs/tree/main/cve_2022_31626_remote_exploit
#php #cve
21 579
CVE-2022-22980
A local based poc of CVE-2022-22980
https://github.com/trganda/CVE-2022-22980
Research:
https://tanzu.vmware.com/security/cve-2022-22980
#cve #poc
21 579
Noscrape
Obfuscate text via node to make scraping your content really difficult.
The key behind is to use any true-type font from which noscrape generates a new version with shuffled Unicode and nothing that one can use to calculate them back. Strings and Integers become obfuscated and are only readable by using the generated obfuscation font.
https://github.com/schoenbergerb/noscrape
@HackGit
21 579
CustomActiveScanForZAP
A OWASP ZAP AddOn ActiveScan for detecting SQL injections. Real Web application page has dynamic contents such as special sale products list or CSRF token, which is not affected by input parameters. The web application vulnerability scanner manipulates input parameters to detect vulnerabilities by affecting page content. The scanner may fail to detect vulnerabilities if the dynamic content of the web page has contents which is unaffected by the input parameters. Therefore, this CustomActiveScan uses LCS (Longest Common Sequece) algorithm to remove these unnecessarily dynamic content. Due to this method, this scanner has a superior vulnerability detection capability.
how to remove these dynamic contents which is not affected input parameters.
LCS(Longest Common Sequence) algorighm extracts the content that is common to two array elements. For example, you have a web page that contains a CSRF token. The CSRF token has a unique value for each http request. To erase this token, this addon sends two identical http requests and computes the response LCS of the two requests. LCS remove the different token values from the two responses as follows:
https://github.com/gdgd009xcd/CustomActiveScanForZAP
@HackGit
21 579
FLARE Obfuscated String Solver
Rather than heavily protecting backdoors with hardcore packers, many malware authors evade heuristic detections by obfuscating only key portions of an executable. Often, these portions are strings and resources used to configure domains, files, and other artifacts of an infection. These key features will not show up as plaintext in output of the strings.exe utility that we commonly use during basic static analysis.
The FLARE Obfuscated String Solver (FLOSS, formerly FireEye Labs Obfuscated String Solver) uses advanced static analysis techniques to automatically deobfuscate strings from malware binaries. You can use it just like strings.exe to enhance basic static analysis of unknown binaries.
FLOSS extracts all the following string types:
▫️ static strings: "regular" ASCII and UTF-16LE strings
▫️ stack strings: strings constructed on the stack at run-time
▫️ tight strings: special form of stack strings, decoded on the stack
▫️ decoded strings: strings decoded in a function
https://github.com/mandiant/flare-floss
@HackGit
21 579
zphisher
A beginners friendly, Automated phishing tool with 30+ templates.
Features:
▫️ Latest and updated login pages.
▫️ Mask URL support
▫️ Beginners friendly
▫️ Docker support (checkout docker-legacy branch)
▫️ Multiple tunneling options
▫️ Localhost
▫️ Ngrok (With or without hotspot)
▫️ Cloudflared (Alternative of Ngrok)
https://github.com/htr-tech/zphisher
@HackGit
21 579
Thread Stack Spoofing / Call Stack Spoofing PoC
A PoC implementation for an advanced in-memory evasion technique that spoofs Thread Call Stack. This technique allows to bypass thread-based memory examination rules and better hide shellcodes while in-process memory.
This is an example implementation for Thread Stack Spoofing technique aiming to evade Malware Analysts, AVs and EDRs looking for references to shellcode's frames in an examined thread's call stack. The idea is to hide references to the shellcode on thread's call stack thus masquerading allocations containing malware's code.
Implementation along with my ShellcodeFluctuation brings Offensive Security community sample implementations to catch up on the offering made by commercial C2 products, so that we can do no worse in our Red Team toolings. 💪
https://github.com/mgeeky/ThreadStackSpoofer
@HackGit
21 579
WebHackUrls
#Simple python #OSINT tool for urls recon thanks to the waybackmachine.
https://github.com/mathis2001/WebHackUrls
@HackGit
21 579
ASScan
Attack Surface Scan, The Real Passive Scan, It's like a submarine.
Functions:
▫️ API、SubDomain or other information found for JavaScript file.
▫️ AccessKey/SecretKey found for JavaScript file.
▫️ Dom Vulnerability Insertion point found for JavaScript file.
▫️ Broken Authentication Insertion point found for API.
▫️ Sensitive Data expose point found for API.
▫️ XXE or SSRF Insertion point found for API.
▫️ Website's fingerprint found for requests.
▫️ Not to stay up ...
https://github.com/langu-xyz/ASScan
@HackGit
21 579
Crypt-Cobalt-Strike-Powershell
Privat crypt #Cobalt Strike and powershell
https://github.com/trewisscotch/Crypt-Cobalt-Strike-Powershell
@HackGit
