HackGit
Kanalga Telegram’da o‘tish
The channel was created for cybersecurity specialists. • Offensive Security • RedTeam • Malware Research • BugBounty • OSINT • etc Disclaimer: t.me/hackgit/2082 Donations - Ads: t.me/hackgit/5423
Ko'proq ko'rsatish📈 Telegram kanali HackGit analitikasi
HackGit (@hackgit) Ingliz til segmentidagi kanali faol ishtirokchi. Hozirda hamjamiyat 21 579 obunachidan iborat bo'lib, Texnologiyalar & Aralashmalar toifasida 4 526-o'rinni va AQSH mintaqasida 1 853-o'rinni egallagan.
📊 Auditoriya ko‘rsatkichlari va dinamika
невідомо sanasidan buyon loyiha tez o‘sib, 21 579 obunachiga ega bo‘ldi.
02 Mart, 2025 dagi oxirgi ma’lumotlarga ko‘ra kanal barqaror faollikka ega. Oxirgi 30 kunda obunachilar soni 19 ga, so‘nggi 24 soatda esa 0 ga o‘zgardi va umumiy qamrov yuqori darajada qolmoqda.
- Tasdiqlash holati: Tasdiqlanmagan
- Jalb etish (ER): Auditoriya o‘rtacha 0% darajada jalb etiladi. Nashrdan keyingi dastlabki 24 soatda kontent odatda umumiy obunachilar sonining N/A% ini tashkil etuvchi reaksiyalarni to‘playdi.
- Post qamrovi: Har bir post o‘rtacha 0 marta ko‘riladi; birinchi sutkada odatda 0 ta ko‘rish yig‘iladi.
- Reaksiyalar va o‘zaro ta’sir: Auditoriya faol: har bir postga o‘rtacha 0 ta reaksiya keladi.
📝 Tavsif va kontent siyosati
Muallif resursni shaxsiy fikrni ifoda etish maydoni sifatida ta’riflaydi:
“The channel was created for cybersecurity specialists.
• Offensive Security
• RedTeam
• Malware Research
• BugBounty
• OSINT
• etc
Disclaimer:
t.me/hackgit/2082
Donations - Ads:
t.me/hackgit/5423”
Yuqori yangilanish chastotasi (oxirgi ma’lumot 03 Mart, 2025 da olingan) sababli kanal doimo dolzarb va katta qamrovli bo‘lib qoladi. Analitika auditoriya kontent bilan faol hamkorlik qilishini, uni Texnologiyalar & Aralashmalar toifasidagi muhim ta’sir nuqtasiga aylantirishini ko‘rsatadi.
21 579
Obunachilar
Ma'lumot yo'q24 soatlar
-37 kun
+1930 kun
Postlar arxiv
21 579
N3XT-G3N Web App Firewall (NGWAF)
With the explosive growth of web applications since the early 2000s, web-based attacks have progressively become more rampant. One common solution is the Web Application Firewall (WAF).
However, tweaking rules of current WAFs to improve the detection mechanisms can be complex and difficult.
NGWAF seeks to address these drawbacks with a novel machine learning and quarantine-to-honeypot based architecture.
https://github.com/FA-PengFei/NGWAF
21 579
Ultra
A Small Poc On An Encryption/Decryption Algorithm Used As A File Locker.
https://github.com/ORCx41/Ultra
t.me/hackgit
21 579
AMSI-ETW-Patch
this repo contains information to patch AMSI and ETW using a single byte patch for both.
The idea was to limit detection of the patch itself since it's a single byte.
https://github.com/Mr-Un1k0d3r/AMSI-ETW-Patch
21 579
Repost from Pentesting Shop
DSTIKE WIFI Duck
This open source project aims to provide a user-friendly tool to learn about keystroke injection attacks. A microcontroller acts as a USB keyboard that is programmable over WiFi. It’s using the Ducky Script language that Hak5 introduced with the USB Rubber Ducky.
A keyboard is trusted by most operating systems by default, which enables for a variety of attacks. Humans might not type very fast, but an automated device like this can. It can open a terminal and mess with your computer in a matter of a milliseconds!
Spacehuhn has a lot of interesting projects, WiFi duck is a new version different from old WiFi ducky. For more details please check. Schematic pdf.
What makes it special?
▫️ 4MB Flash ESP-WROOM-02
▫️ Atmega32u4
▫️ IIC connection between ESP8266 and Atmega32u4
▫️ RGB LED
▫️ DIP Switch for different mode:
▫️ Arduino Flash Mode: 10101010
▫️ ESP8266 Flash Mode: 01011101
▫️ Work Mode: 10101101
Buy online:
🛒 https://bit.ly/3ngEDLR (ali)
🛒 https://amzn.to/3UL4uKH (amazon)
#wifi #duck
21 579
CVE-2022-43332
Cross Site Scripting in WonderCMS
A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows potential attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel - coupled with the fact that the cookie has no HttpOnly Flag this could be used to steal cookies of logged-in users.
https://github.com/maikroservice/CVE-2022-43332
#cve
21 579
CVE-2021-40438
Apache HTTP Server 2.4.48 - A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.
https://github.com/WilsonFung414/CVE-2021-40438_Docker_2
t.me/hackgit
21 579
ODGen
ODGen is a tool to detect vulnerabilities in Node.js packages. This project is written in Python and JavaScript and the source code is included in the repository.
https://github.com/Song-Li/ODGen
21 579
Canary Hunter
Hunting for Canary Tokens in various formats.
While executing multiple red team engagements over the past few years there have been multiple times where I have run up against Canary Tokens which could potentially alert the SOC to actions taken.
As such I spent some time running down the rabbit hole discovering if there were ways to detect these canaries within files present within the environment.
Canary Hunter was formed to quickly check for Common Canaries in various formats generated for free on canarytokens.org
https://github.com/C0axx/CanaryHunter
21 579
YATAS
Yet Another Testing & Auditing Solution
The goal of YATAS is to help you create a secure AWS environment without too much hassle. It won't check for all best practices but only for the ones that are important for you based on my experience. Please feel free to tell me if you find something that is not covered.
https://github.com/padok-team/YATAS
21 579
Awesome Event IDs
Collection of Event ID resources useful for Digital Forensics and Incident Response
In incidents, analysts are often faced with the problem of interpreting unknown event IDs. The event itself does not always contain the desired information. In addition, it is impossible to remember them all, given the huge number of event IDs and log sources.
https://github.com/stuhli/awesome-event-ids
21 579
XSS Hunter Express
The fastest way to set up XSS Hunter to test and find blind cross-site scripting vulnerabilities.
https://github.com/mandatoryprogrammer/xsshunter-express
21 579
Repost from Pentesting Shop
Wi-Fi 6 mesh router WRX560
High performance mesh-ready router in a space-saving design!
WRX560 is engineered for demanding networks where connectivity is essential. Wi-Fi 6 technology combined with six MIMO high-performance internal antennas, four dedicated to 5GHz and two for 2.4GHz. Together, they bring higher speeds to more devices at greater ranges, all in a compact form factor.
Wi-Fi 6 technology: combined with high-performance internal antennas bring higher speeds to more devices at greater ranges, all in a compact design.
Signal booster for large homes: combine multiple Synology routers (WRX560 or other) for consistent and high-speed whole-home coverage under a single Wi-Fi name.
Network segmentation and security: Isolate networks, for example, between home and work, or set access rules to limit connectivity to and from vulnerable devices.
Use intuitive controls to separate Wi-Fi and cabled networks for your PCs and entertainment, camera surveillance, and smart devices. Then create access rules between networks to prevent horizontal attacks.
▫️ Synology VPN Plus included
▫️ Comprehensive parental controls customizable to your needs
▫️ Monitor network and device usage in real-time, even while away
▫️ Quick and easy setup with free mobile app for iOS or Android
Buy online:
🛒 https://amzn.to/3A3hJyB
#router #mesh
21 579
bkcrack
Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
bkcrack is a command-line tool which implements this known plaintext attack. The main features are:
▫️ Recover internal state from ciphertext and plaintext.
▫️ Change a ZIP archive's password using the internal state.
▫️ Recover the original password from the internal state.
https://github.com/kimci86/bkcrack
21 579
Active Directory Pentest Mindmap.
https://github.com/Orange-Cyberdefense/arsenal/raw/master/mindmap/pentest_ad.png
Web: https://www.xmind.net/m/5dypm8/
#mindmap #ad #pentesting
21 579
CVE-2022-3699
Incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory read/write.
https://github.com/alfarom256/CVE-2022-3699
#cve
21 579
Shadow Workers
Shadow Workers is a free and open source C2 and proxy designed for penetration testers to help in the exploitation of XSS and malicious Service Workers (SW).
A successful exploitation allows you to browse on the targeted application as the victim(s), as long as the SW (agent) is active. A victim does not have to have a browser tab open in the application for the agent to be active.
https://github.com/shadow-workers/shadow-workers
Shadow Workers Site:
https://shadow-workers.github.io/
21 579
MSIExecEoP
Arbitrary File Delete in Windows Installer before 10.0.19045.2193
Msiexec perform file operation in user controlled directory without impersonation which leads to arbitrary file delete.
Msiexec relies on restrictive DACL inside C:\users%username%\appdata\roaming\microsoft\installer directory which are set only to allow everyone group read access, but as user have DELETE privileges on parent directory installer directory can be moved and recreated with permissive DACL.
https://github.com/Wh04m1001/MSIExecEoP
21 579
RPC Firewall
Check out our RPC Firewall blog post or our BlackHat talk to gain better understanding of RPC, RPC attacks and the solution: the RPC Firewall.
RPC is the underlying mechanism which is used for numerous lateral movement techniques, reconnaissance, relay attacks, or simply to exploit vulnerable RPC services.
DCSync attack? over RPC. Remote DCOM? over RPC. WMIC? over RPC. SharpHound? over RPC. PetitPotam? over RPC. PsExec? over RPC. ZeroLogon? over RPC... well, you get the idea :)
https://github.com/zeronetworks/rpcfirewall
21 579
Unix-like Artifacts Collector
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts. It was created to facilitate and speed up data collection, and depend less on remote support during incident response engagements.
https://github.com/tclahr/uac
21 579
S3Viewer
s3viewer is a free tool for security researchers that lists the content of publicly open storages and helps to identify leaking data. The tool allows you to view all the files in a given storage and download selected files and directories. The goal is to identify the owner of the storage as quickly as possible in order to report that data is leaking from it.
Supported open storage:
▫️ Amazon S3 Buckets
▫️ Microsoft Azure Blobs
▫️ FTP servers with Anonymous access allowed
▫️ HTTP Index Of / Pages (Apache/nginx-style directory listing)
https://github.com/SharonBrizinov/s3viewer
