loveshell

picoclaw. Tiny, Fast, and Deployable anywhere — automate the mundane, unleash your creativity

EDRception. A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.

EDR-Preloader. An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer

Jatayu. Stealthy Stand Alone PHP Web Shell

kingkong. 解密哥斯拉webshell管理工具流量

AgentMemShellScanner. 清除基于java agent木马

SharpRDPHijack. A proof-of-concept Remote Desktop (RDP) session hijack utility

netcap. A framework for secure and scalable network traffic analysis - https://netcap.io

xwaf. Automatic bypass (brute force) waf

wechat_autojump_game. 用Golang实现微信跳一跳游戏自动玩

Scanners-Box. A powerful and open-source toolkit for hackers and security automation - 安全行业从业者自研开源扫描器合辑

mimipenguin. A tool to dump the login password from the current linux user

mimikatz. A little tool to play with Windows security

Suricata-Signatures. Suricata rules for Emerging Threats and funkyness

awesome-appsec. A curated list of resources for learning about application security

ivre. Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.

sec-scanner. Static code analyser for security scanning

lua-resty-logger-socket. Raw-socket-based Logger Library for Nginx (based on ngx_lua)

DiabloHorn. Projects and POCs

ngx_lua_waf. ngx_lua_waf是一个基于lua-nginx-module(openresty)的web应用防火墙

sregex. A non-backtracking NFA/DFA-based Perl-compatible regex engine matching on large data streams

ironbee-dev-tools. IronBee Development Tools

sslstrip. A tool for exploiting Moxie Marlinspike's SSL "stripping" attack.

ironbee. Universal web application security sensor intended for real-time monitoring and defense.

waf-research. WAF Research

Weevely. Stealth tiny web shell

xsschef. Chrome extension Exploitation Framework

ngx_openresty. Turning Nginx into a Full-fledged Web App Server

icecast-logs-parser. icecast Logs Parser

arachni. Web Application Security Scanner Framework

libinjection. SQL / SQLI tokenizer parser analyzer

sqlmap. Automatic SQL injection and database takeover tool

VFW. Varnish Firewall

security.vcl. protect your websites with varnish rules

httpfs. Remote FUSE filesystem via server-side script

libinjection. SQL / SQLI tokenizer parser analyzer

exploits. various exploits

icecast-logs-parser. icecast Logs Parser

keimpx. Check for valid credentials across a network over SMB

sqlmap. Automatic SQL injection and database takeover tool

php-websocket. A simple PHP WebSocket implementation for PHP 5.3

chapcrack. Python

falcon. Falcon是一款基于inotify-tools 开发的Web服务器文件监控平台 能够实时监控Web目录文件变化(新增，修改，删除)，判断文件内容是否包含恶意代码，自动隔离常见Webshell，保证Web目录文件安全

IDSDeathBlossom. IDS Utility Belt For Automating/Testing Various Things

tengine. A distribution of Nginx with some advanced features

powershell_scripts. Powershell Scripts

xsschef. Chrome extension Exploitation Framework

testcookie-nginx-module. simple robot mitigation module using cookie based challenge/response technique. Not supported any more.

FileGuard. FireGuard prevents files by restoring them automatically when they are altered or accidentally removed.

xssprobe. xss probe to steal page info: browser, ua, lang, referer, location, toplocation, cookie, domain, title, screen, flash, etc.

python-webshell. webshell writen in python

pygeoip. DEPRECATED: Pure Python API for Maxmind's binary GeoIP databases

ironbee-dev-tools. IronBee Development Tools

beef. The Browser Exploitation Framework Project

tcpcopy. An online request replication and TCP stream replay tool, ideal for real testing, performance testing, stability testing, stress testing, load testing, smoke testing, and more.

VFW. Varnish Firewall

Shell-Detector. Shell Detector – is a application that helps you find and identify php/cgi(perl)/asp/aspx shells. Shell Detector has a “web shells” signature database that helps to identify “web shell” up to 99%.

bootstrap. The most popular HTML, CSS, and JavaScript framework for developing responsive, mobile first projects on the web.

luacipher. LuaCipher is a LUA extension that can be used to process common cryptographic algorithms.

DSSS. Damn Small SQLi Scanner

PHP-Shell-Detector. Web Shell Detector – is a php script that helps you find and identify php/cgi(perl)/asp/aspx shells. Web Shell Detector has a “web shells” signature database that helps to identify “web shell” up to 99%.

htshells. Self contained htaccess shells and attacks

AntiXSS-for-Java. AntiXSS for Java is a port of the Microsoft Anti-Cross Site Scripting (AntiXSS) v1.5 library for .NET applications. The library requires Java 1.4 or higher, but has no other prerequisites.

sslstrip. A tool for exploiting Moxie Marlinspike's SSL "stripping" attack.

proxychains. proxychains - a tool that forces any TCP connection made by any given application to follow through proxy like TOR or any other SOCKS4, SOCKS5 or HTTP(S) proxy. Supported auth-types: "user/pass" for SOCKS4/5, "basic" for HTTP.

ModSecurity. ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

ironbee. Universal web application security sensor intended for real-time monitoring and defense.

dnsrecon. DNS Enumeration Script

security.vcl. protect your websites with varnish rules

Vega. Subgraph Vega

arachni. Web Application Security Scanner Framework

lua-nginx-module. Embed the Power of Lua into NGINX HTTP servers

nginx_tcp_proxy_module. add the feature of tcp proxy with nginx, with health check and status monitor

graudit. grep rough audit - source code auditing tool