ustayready

fireprox. AWS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation

CredSniper. CredSniper is a phishing framework written with the Python micro-framework Flask and Jinja2 templating which supports capturing 2FA tokens.

CredKing. Password spraying using AWS Lambda for IP rotation

SharpHose. Asynchronous Password Spraying Tool in C# for Windows Environments

python-pentesting. Just a repo of random Python scripts to get pentesters started with the Python language on engagements.

golddigger. Python

cloudgpt. Vulnerability scanner for AWS customer managed policies using ChatGPT

CasperStager. PoC for persisting .NET payloads in Windows Notification Facility (WNF) state names using low-level Windows Kernel API calls.

wnfexec. WNF Code Execution Library Using C#

ShredHound. Small utility to chunk up a large BloodHound JSON file into smaller files for importing.

DirectAI. ChatGPT queries via OpenAI API in your terminal

tradecraft. Red Teaming Tradecraft

CloudBurst. CloudBurst is a red team framework for interacting with cloud providers to capture, compromise, and exfil data.

roguerdp.

outpost. AWS Testing and Reporting Management Tool

android-app-recovery. Scripts to parse large Android binary images and extracts deleted data from apps

redteam-plan. Issues to consider when planning a red team exercise.

mavd. Mobile Application Vulnerability Detection

physical-analyzer-scripts. Cellebrite Physical Analyzer python scripts to aid analysts with extended functionality

Awesome-Cellular-Hacking. Awesome-Cellular-Hacking

googlerecon. Google Recon for Pentesting

PCredz. This tool extracts Credit card numbers, NTLM(DCE-RPC, HTTP, SQL, LDAP, etc), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a pcap file or from a live interface.

KingOfBugBountyTips. Go

hacktricks. Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

Privilege-Escalation. This cheasheet is aimed at the CTF Players and Beginners to help them understand the fundamentals of Privilege Escalation with examples.

cuddlephish. Weaponized Browser-in-the-Middle (BitM) for Penetration Testers

pynse. NSE to launch Python Scripts

ai-notes. notes for my AI studies, writing, and product brainstorming

CredMaster. Refactored & improved CredKing password spraying tool, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling

Nemesis. An offensive data enrichment pipeline

injection. Windows process injection methods

awesome-canbus. :articulated_lorry: Awesome CAN bus tools, hardware and resources for Cyber Security Researchers, Reverse Engineers, and Automotive Electronics Enthusiasts.

XSStrike. Most advanced XSS detection suite.

truffleHog. Searches through git repositories for high entropy strings and secrets, digging deep into commit history

XtoTwitter. JavaScript

awesome-flipperzero. 🐬 A collection of awesome resources for the Flipper Zero device.

ConditionalAccessDocumentation. Azure AD Conditional Access Documentation with PowerShell

HijackLibs. Project for tracking publicly disclosed DLL Hijacking opportunities.

CVE-2020-1472. PoC for Zerologon - all research credits go to Tom Tervoort of Secura

qrwifi. QRCode Wifi Generator

AllAboutBugBounty. All about bug bounty (bypasses, payloads, and etc)

forensicpy. Library for performing mobile device decoding for nibbles and 7-bit decoding

oauthseeker. A malicious OAuth application that can be leveraged for both internal and external phishing attacks targeting Microsoft Azure and Office365 users.

pyslite. Script for performing SQLite database to Excel workbook conversions

r0ak. r0ak ("roak") is the Ring 0 Army Knife -- A Command Line Utility To Read/Write/Execute Ring Zero on for Windows 10 Systems

MiscTools. Miscellaneous Tools

wig. WebApp Information Gatherer

PayloadsAllTheThings. A list of useful payloads and bypass for Web Application Security and Pentest/CTF

MoveEdr. Permanently disable EDRs as local admin

PowerSploit. PowerSploit - A PowerShell Post-Exploitation Framework

DriverJack. Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths

sandbox-attacksurface-analysis-tools. Set of tools to analyze and attack Windows sandboxes.

digraph. A digraph plotter for sequential byte visualization

MacMalware. macOS Malware Collection

hackaday-u. Course materials for hackaday.io Ghidra training

tun2socks. tun2socks - powered by gVisor TCP/IP stack

puppeteer. Headless Chrome Node API

RedTeamCCode. Red Team C code repo

BamboozlEDR. A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.