Andreas Georgiou

Cheatsheets. A list of Cheatsheet compiled by CloudBreach Team

EnvWatch. A Go utility that scans your system for exposed secrets in environment variables and .env files.

DreadGOAD. Go

InfoSec-Black-Friday. All the deals for InfoSec related software/tools this Black Friday

aws_public_ips. Fetch all public IP addresses tied to your AWS account. Works with IPv4/IPv6, Classic/VPC networking, and across all AWS services

cobalt-arsenal. My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+

RedWarden. Cobalt Strike C2 Reverse proxy that fends off Blue Teams, AVs, EDRs, scanners through packet inspection and malleable profile correlation

OffensiveCSharp. Collection of Offensive C# Tooling

MSOLSpray. A password spraying tool for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.

awesome-cloud-security. 🛡️ Awesome Cloud Security Resources ⚔️

CVE-2022-22536. SAP memory pipes(MPI) desynchronization vulnerability CVE-2022-22536.

cve. Gather and update all available and newest CVEs with their PoC.

ntlm_theft. A tool for generating multiple types of NTLMv2 hash theft files by Jacob Wilkin (Greenwolf)

cs-suite. Cloud Security Suite - One stop tool for auditing the security posture of AWS/GCP/Azure infrastructure.

charlotte. c++ fully undetected shellcode launcher ;)

ScoutSuite. Multi-Cloud Security Auditing Tool

Active-Directory-Exploitation-Cheat-Sheet. A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

TakeATest. JavaScript

lyncsmash. locate and attack Lync/Skype for Business

adfsbrute. A script to test credentials against Active Directory Federation Services (ADFS), allowing password spraying or bruteforce attacks.

Redcloud. Automated Red Team Infrastructure deployement using Docker

CCSC-CTF-2021. Official challenge repository of CCSC CTF 2021

nmap-parse-output. Converts/manipulates/extracts data from a Nmap scan output.

azucar. Security auditing tool for Azure environments

invoke-atomicredteam. Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team project.

BurpSuite_403Bypasser. Burpsuite Extension to bypass 403 restricted directory

gitGraber. gitGraber: monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...

Ghostwriter. The SpecterOps project management and reporting engine

Stormspotter. Azure Red Team tool for graphing Azure and Azure Active Directory objects

fuzzdb. Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

overlord. Overlord - Red Teaming Infrastructure Automation

CVE-2019-18935. RCE exploit for a .NET JSON deserialization vulnerability in Telerik UI for ASP.NET AJAX.

cloudsplaining. Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.

Nessus_Map. Parse .nessus file(s) and shows output in interactive UI

crackq. CrackQ: A Python Hashcat cracking queue system

public-pentesting-reports. A list of public penetration test reports published by several consulting firms and academic security groups.

lscript. The LAZY script will make your life easier, and of course faster.

CCSC-CTF-2020. All challenges for the CCSC 2020 CTF

evilginx2. Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

ovisbot. Discord bot focused on managing and organising CTFs / Security stuff

SecLists. SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

medusa. Medusa is a speedy, parallel, and modular, login brute-forcer.

brutespray. Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.

AttackSurfaceMapper. AttackSurfaceMapper is a tool that aims to automate the reconnaissance process.

requests-html. Pythonic HTML Parsing for Humans™

BKScan. BlueKeep scanner supporting NLA

static-binaries. Various *nix tools built as statically-linked binaries

metasploit-framework. Metasploit Framework

VHostScan. A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.

Photon. Incredibly fast crawler designed for OSINT.

CatMyPhish. Search for categorized domain

PandorasBox. Security tool to quickly audit Public Box files and folders.

CrackMapExec. A swiss army knife for pentesting networks

aws-security-checks. AWS Security Checks

hackthebox-writeups. Writeups for HacktheBox 'boot2root' machines

cisco_pwdecrypt. Simple Python tool to decrypt the "enc_GroupPwd" variable in PCF files (and type 5/7 passwords).

MITMf. Framework for Man-In-The-Middle attacks

phishing_catcher. Phishing catcher using Certstream

XSStrike. Most advanced XSS scanner.

EyeWitness. EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

DoHC2. DoHC2 allows the ExternalC2 library from Ryan Hanson (https://github.com/ryhanson/ExternalC2) to be leveraged for command and control (C2) via DNS over HTTPS (DoH).

SlackExtract. A PowerShell script to download all files, messages and user profiles that a user has access to in slack.

LogRM. LogRM is a post exploitation powershell script which it uses windows event logs to gather information about internal network

email-Spoofer. Simple Email/MMS spoofer included mass mail attack feature and a compatible mobile version

SimpleEmailSpoofer. A simple Python CLI to spoof emails.

sheepl. Sheepl : Creating realistic user behaviour for supporting tradecraft development within lab environments

lanturtle-modules. The Official LAN Turtle Module Repository

AWSBucketDump. Security Tool to Look For Interesting Files in S3 Buckets

social_mapper. A Social Media Enumeration & Correlation Tool by Jacob Wilkin(Greenwolf)

Namechk. Osint tool based on namechk.com for checking usernames on more than 100 websites, forums and social networks.

ssh-auditor. The best way to scan for weak ssh passwords on your network

IntruderPayloads. A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

gophish. Open-Source Phishing Toolkit

Airachnid-Burp-Extension. A Burp Extension to test applications for vulnerability to the Web Cache Deception attack

ipv4Bypass. Using IPv6 to Bypass Security

awesome-threat-intelligence. A curated list of Awesome Threat Intelligence resources

nikto. Nikto web server scanner

BloodHound-Legacy. Six Degrees of Domain Admin

pentest_scripts. Python

GitTools. A repository with 3 tools for pwn'ing websites with .git repositories available

PoSHBypass. C#

struts-pwn. An exploit for Apache Struts CVE-2017-5638

HELK. The Hunting ELK

spaces-finder. A tool to hunt for publicly accessible DigitalOcean Spaces

masscan. TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.

PCredz. This tool extracts Credit card numbers, NTLM(DCE-RPC, HTTP, SQL, LDAP, etc), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a pcap file or from a live interface.

DET. (extensible) Data Exfiltration Toolkit (DET)

spiderfoot. SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

Responder. Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

Spray. A Password Spraying tool for Active Directory Credentials by Jacob Wilkin(Greenwolf)

HostHunter. HostHunter a recon tool for discovering hostnames using OSINT techniques.

ip2hosts. Dirty bash script to obtain hosts given an IP address

httprecon-nse. Advanced web server fingerprinting for Nmap

wordlist. Collection of some common wordlists such as RDP password, user name list, ssh password wordlist for brute force. IP Cameras Default Passwords.

goGetBucket. A penetration testing tool to enumerate and analyse Amazon S3 Buckets owned by a domain.

altdns. Generates permutations, alterations and mutations of subdomains and then resolves them

Mastering-Modern-Web-Penetration-Testing. Code repository for Mastering Modern Web Penetration Testing, published by Packt

respounder. Respounder detects presence of responder in the network.

API-InstagramLocation. Python OSINT Tool to retrieve pictures from a specific location using Instagram API

massSSL. A simple script for testing multiple hundred of hosts for SSL/TSL configuration.

TeamViewer_Permissions_Hook_V1. A proof of concept injectable C++ dll, that uses naked inline hooking and direct memory modification to change your TeamViewer permissions.

steamer. For importing, searching, and managing public password breach data

sphinx. External Network Reconnaissance script

Prowl. Python

GRASSMARLIN. Provides situational awareness of Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) networks in support of network security assessments. #nsacyber

sslscan. sslscan tests SSL/TLS enabled services to discover supported cipher suites

ModSecurity. ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

openssl. General purpose TLS and crypto library

mdns_recon. Multicast DNS and DNS service discovery daemons deployed on various systems across the Internet are misconfigured and reply to queries targeting their unicast addresses, including requests from their WAN interface. These daemons could be leveraged by attackers for sensitive information disclosure and potentially used in DDoS campaigns for reflection and in some cases amplification. This vulnerability was made public in cordination with CERT (http://www.kb.cert.org/vuls/id/550620)

bet2512. A custom Dockerfile, ooniprobe test deck and URL list compiled from different version of blocklists introduced in Cyprus.

Responder. Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

webshells. Various webshells. We accept pull requests for additions to this collection.

datasploit. An #OSINT Framework to perform various recon techniques on Companies, People, Phone Number, Bitcoin Addresses, etc., aggregate all the raw data, and give data in multiple formats.

php-webshells. Common PHP webshells you might need for your Penetration Testing assignments or CTF challenges. Do not host the file(s) on your server!

IIS-ShortName-Scanner. latest version of scanners for IIS short filename (8.3) disclosure vulnerability

sslyze. Fast and powerful SSL/TLS scanning library.

zaproxy. The ZAP by Checkmarx Core project

pupy. Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

snoopy-ng. Snoopy v2.0 - modular digital terrestrial tracking framework

XSSChallengeWiki. Welcome to the XSS Challenge Wiki!

dotcom. The mothership website for hack{cyprus}

sqlmap. Automatic SQL injection and database takeover tool

Pillow. Python Imaging Library (fork)

p2p-adb. Phone to Phone Android Debug Bridge - A project for "debugging" phones... from other phones.

GeoTrust. Signing keys

beef. The Browser Exploitation Framework Project

testssl.sh. Testing TLS/SSL encryption anywhere on any port

wifiphisher. The Rogue Access Point Framework