Chris Frohoff

ysoserial. A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

jdk8u-jdk. Java

ciphr. CLI crypto swiss-army knife for performing and composing encoding, decoding, encryption, decryption, hashing, and other various cryptographic operations on streams of data from the command line; mostly intended for ad hoc, infosec-related uses.

inspector-gadget. Primitive tool for exploring/querying Java classes via the Tinkerpop Gremlin graph traversal language

grepcidr. from http://www.pc-tools.net/unix/grepcidr/

marshalsec. Java

jdk8u-dev-jdk. Java

jdeserialize. From https://code.google.com/p/jdeserialize/

rails_exploits. Ruby

serialysis. from http://weblogs.java.net/blog/emcmanus/archive/2007/06/disassembling_s.html

pd-buddy-wye. From https://git.clarahobbs.com/pd-buddy/pd-buddy-wye.git

extract-ssl-secrets. Decrypt HTTPS/SSL/TLS connections on the fly with Wireshark

appseccali-java. Java

ctfd-trektheme. Star Trek LCARS inspired pure CSS theme for CTFd (v2.1.1) used during the 2019 LayerOne CTF and ToorCon CTF.

bocker. Docker implemented in around 100 lines of bash

inyourface. From http://www.synacktiv.com/ressources/inyourface-0.2.tar.gz

appseccali-marshalling-pickles. Slide deck from AppSecCali 2015 Talk "Marshalling Pickles: how deserializing objects will ruin your day"

sleepyhead. imported from https://sourceforge.net/projects/sleepyhead/

owaspsd-deserialize-my-shorts. Slide deck from OWASP SD Talk "Deserialize My Shorts: Or How I Learned to Start Worrying and Hate Java Object Deserialization"

grepcidr2. from http://www.taugh.com/grepcidr-2/

Java-Deserialization-Cheat-Sheet. The cheat sheet about Java Deserialization vulnerabilities

revsh. A remote access tool for pentesters designed for advanced pivoting.

jimmix. From http://www.synacktiv.com/ressources/jimmix-0.3.tar.gz

burp-plugin-requestutils. Plugin for manipulating requests in PortSwigger Burp Suite Pro v1.5+

jdk7u. Java

security_monkey. Security Monkey

CTFd. CTFs as you need them

shellshock-pocs. Perl

d3-profile-viewer. Java

rest-client. Simple HTTP and REST client for Ruby, inspired by microframework syntax for specifying actions.

jsdetox. A Javascript malware analysis tool

self-compile-Android. Autonomous smartphone app. Capable of self-compilation, mutation, and viral spreading. World-first proof-of-principle to bypass Internet kill switches.

reverse-proxy-auth-plugin. Java

pacemaker. Heartbleed (CVE-2014-0160) client exploit

gitlabhq. Project management and code hosting application. Follow us on twitter @gitlabhq

Empire. Empire is a PowerShell and Python post-exploitation agent.

pupy. Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python

jdk6. Java

jmitm2. From http://www.david-guembel.de/uploads/media/jmitm2-0.1.0-source.tar.gz

multiplexd. run ssh, https, and openvpn on the same port

Top10. Official OWASP Top 10 Document Repository

Hurl. Choose the browser on the click of a link

frohoff.github.io. Github Pages Site

JavaPayload. JavaPayload is a collection of pure Java payloads to be used for post-exploitation from pure Java exploits or from common misconfigurations (like not password protected Tomcat manager or debugger port).

libbf. Library for binary file manipulation

lambda-zip-test. docker run -v [homedir]/.aws/:/root/.aws/ -e AWS_DEFAULT_PROFILE=[profilename] [containerid]

sparring. Network simulation for malware analysis.

javascript-playlist-parser. Parse m3u, pls, and asx in JavaScript

pwnableweb-scoreboard. Scoreboard for CTF Competitions

ghidra. Ghidra is a software reverse engineering (SRE) framework

pwdagent. A barebones CLI utility to prompt for and cache a password in memory, then hand it out over HTTP or raw TCP

cloudwatch-logs-subscription-consumer. A specialized Amazon Kinesis stream reader (based on the Amazon Kinesis Connector Library) that can help you deliver data from Amazon CloudWatch Logs to any other system in near real-time using a CloudWatch Logs Subscription Filter.

git. Git Source Code Mirror - This is a publish-only repository and all pull requests are ignored. Please follow Documentation/SubmittingPatches procedure for any of your improvements.

dotfiles. Shell

ircbots. Scala

appseccali-rails-redis. Ruby

JMD. Java bytecode analysis/deobfuscation tool

burp-debug. Java