BytePhantom

GitHub-User-Analyzer. GitHub User Analyzer is a lightweight Python tool that leverages the GitHub API to retrieve and display detailed information about a GitHub user. This tool is perfect for quickly exploring profile data, followers, and public repositories.

base64-to-tgs. Python

3snake. Tool for extracting information from newly spawned processes

Fuck-Etw. Bypass the Event Trace Windows(ETW) and unhook ntdll.

Reaper. 「💀」Proof of concept on BYOVD attack

Infector. This is a simple process injection made in C for Linux systems

gtranslator. gtranslator is a Go command-line tool that enables text translation to various languages using the Google Translate API.

dnschef. DNSChef - DNS proxy for Penetration Testers and Malware Analysts

SpotX. SpotX patcher used for patching the desktop version of Spotify

ghauri. An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws

enumerate-iam. Enumerate the permissions associated with AWS credential set

Windows-Exploit-Suggester. This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins.

palestras-aratu. Organização das palestras - Evento Aratu | Boitatech

SQLi. It is a tool for scanning and exploiting the famous SQL injection vulnerability in more than millions of sites. The exploit was programmed by the TYG team.

D3m0n1z3dShell. Demonized Shell is an Advanced Tool for persistence in linux.

xss-hawkeye.

ejpt. some eJPT exam preparation notes

ZoomEye-python. ZoomEye-python: The official Python library and CLI by Knownsec 404 Team.

OAO. ⚙️ Operating Account Operators (OAO) is a Golang tool to interact with the LDAP protocol to manage account groups, roles, ACLs/ACEs, etc...

alterx. Fast and customizable subdomain wordlist generator using DSL

essence. PHP Lib for web requests

mantra. 「🔑」A tool used to hunt down API key leaks in JS files and pages

Diamorphine. LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)

wolfy. Wolfy AV Bypasser

zram-config. A complete zram-config utility for swap, directories, and logs to reduce SD, NAND and eMMC block wear.

nuclei-burp-plugin. Nuclei plugin for BurpSuite

SimpleASMKernel. 「💻」Simple kernel made in 16-bit assembly only

o365creeper. Python script that performs email address validation against Office 365 without submitting login attempts.

PowerSploit. PowerSploit - A PowerShell Post-Exploitation Framework

systemd-backdoor. A simple script to automate systemd backdoor

Pingoor. 「🚪」Linux Backdoor based on ICMP protocol

Villain. Villain is a high level stage 0/1 C2 framework that can handle multiple reverse TCP & HoaxShell-based shells, enhance their functionality with additional features (commands, utilities) and share them among connected sibling servers (Villain instances running on different machines).

Condor. 「🛡️」AVs/EDRs Evasion tool

Havoc. The Havoc Framework

proxychains-windows. Windows and Cygwin port of proxychains, based on MinHook and DLL Injection

CMSeeK. CMS Detection and Exploitation suite - Scan WordPress, Joomla, Drupal and over 180 other CMSs

CVE-2022-40684. PoC for CVE-2022-40684 - Authentication bypass lead to Full device takeover (Read-only)

libcalc. Privilege Escalation Via suid-so

linux-exploit-suggester. Linux privilege escalation auditing tool

CVE-2019-1388. CVE-2019-1388 UAC提权 (nt authority\system)

Sophos-Vulnerability. CVE-2022-1040

Seatbelt. Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

dnstrace. DNS resolution tracing tool

Farllen. 「🚪」Port forwarding tool to gain access to internal devices

pwnfaces. exploit for CVE-2017-1000486 vulnerability with SOCKS proxy support

poor-mans-pentest. This a collection of the code that I have written for the Poor Man's Pentest presentation.

Awesome-AV-EDR-XDR-Bypass. Awesome AV/EDR/XDR Bypass Tips

phpggc. PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.

RPI4-Covenant-C2-Installer. 「🖥️」Covenant C2 Installer for RPI 4

ropeme. ROPME is a set of python scripts to generate ROP gadgets and payload.

pro. A crappy tool used in our private PS4 jailbreak

bbrf-client. The Bug Bounty Reconnaissance Framework (BBRF) can help you coordinate your reconnaissance workflows across multiple devices

reverse-shell. Reverse Shell as a Service

Awesome-Red-Teaming. List of Awesome Red Teaming Resources

CabalyonTheme.

CVE-2022-33891. 「💥」CVE-2022-33891 - Apache Spark Command Injection

pacu. The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

pocsuite3. pocsuite3 is an open-sourced remote vulnerability testing framework developed by the Knownsec 404 Team.

cve-2022-33891. cve-2022-33891-poc

rubyhackchallenge. Ruby

pwnkit. PoC for the CVE-2021-4034 vulnerability, affecting polkit < 0.120.

jira-mobile-ssrf-exploit. Exploit code for Jira Mobile Rest Plugin SSRF (CVE-2022-26135)

rawhttp. Raw HTTP client in Go for complete request control and customization.

Web-Coldfusion-Vulnerability-POC. Python

PHP-binary-bugs. PHP binary bugs advisory

MBROverwrite. 「💽」MBR Overwrite malware for linux

Pinkerton. 🕵️ Python project to crawl for JavaScript files and search for secrets like API keys, authorization tokens, hardcoded credentials, etc.

CVE-2022-26134. 「💥」CVE-2022-26134 - Confluence Pre-Auth RCE

toxssin. An XSS exploitation command-line interface and payload generator.

SubDiscovery. Subdomain Recon Tool

XSS-Payload. 「💉」XSS Payload List

CRLFsuite. The most powerful CRLF injection (HTTP Response Splitting) scanner.

graphme. a dirty tool to beautify GraphQL Schema Introspection

Corsy. CORS Misconfiguration Scanner

TTWAF. 「🧱」Test a list of payloads and see if you can bypass it

Simple-Calculator. Simple calculator made in c# made for study

Discord-Token-Cheker. Application to check discord user tokens

Consult. PHP

BruteforceDnsSimple. Bruteforce DNS simples

argon-dashboard. Argon - Dashboard for Bootstrap 5 by Creative Tim

vuls. Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

Reconnoitre. A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.

ObjectPwnStream. a Ruby implementation of Java's ObjectInputStream and ObjectOutputStream.

EHoney. 「🍯」Simple low-interaction honeypot with FTP, Telnet and Web

BetterViewer. a replacement for the image viewing mode built into Firefox and Chrome-based web browsers.

CVE-2020-5410-POC. CVE-2020-5410 Spring Cloud Config directory traversal vulnerability

BurpSuite-collections. 有关burpsuite的插件(非商店),文章以及使用技巧的收集(此项目不再提供burpsuite破解文件,如需要请在博客mrxn.net下载)---Collection of burpsuite plugins (non-stores), articles and tips for using Burpsuite, no crack version file

portscanner. Port scanning tool, using Python.

AnonfilesAPI. Anonfiles.com API Wrapper

Wordpress-Exploits. Collection of Exploit, CVES(Unauthenticated) and Wordpress Scanners

1nf0-hunt3r. 『🔍』Simple Information finder using Google Dork

WSOB. 😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.

Cheatsheets. Helped during my OSCP lab days.

CVE-2022-26133. Atlassian Bitbucket Data Center RCE(CVE-2022-26133) verification.

LKM-Command-Line-Parsing. LKM Command Line Parsing - Parte 2

Find-Syscall-table. C

xxe_introduction. explaining xxe vuln

trufflehog. Find, verify, and analyze leaked credentials

SoftGL. C++

insiders. Archive of Potential Insider Threats

introduction-buffer-overflow. buffer overflow basics

twitterBFTD. Twitter Back From The Dead looks in a user tweets history for domain names that are available for registration

markdown-here. Google Chrome, Firefox, and Thunderbird extension that lets you write email in Markdown and render it before sending.

BugBountyTricks. 「🐞」Bug Bounty Tricks

kernel-exploit-factory. Linux kernel CVE exploit analysis report and relative debug environment. You don't need to compile Linux kernel and configure your environment anymore.

BlueTeam-CheatSheets.

the-book-of-secret-knowledge. A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.

firefox_decrypt. Firefox Decrypt is a tool to extract passwords from Mozilla (Firefox™, Waterfox™, Thunderbird®, SeaMonkey®) profiles

interactsh. An OOB interaction gathering server and client library

wfi. Windows File Integrity -- an archive of information on installed Windows binaries.

Rootkit-4x_5x. C

known_hosts-hashcat. A guide and tool for cracking ssh known_hosts files with hashcat

AzureHunter. A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365

gentleman. quick script for mixing wordlists in a way that maintains order. ([1,2],[3,4],[5,6] -> [1,3,5,2,4,6])

gosecretsdump. Dump ntds.dit really fast

Pentest-Cheatsheets. Python

attacktive-directory-tools.

ResolveRex. Simple Dns Resolve Script

CVE-2022-21971. PoC for CVE-2022-21971 "Windows Runtime Remote Code Execution Vulnerability"

CVE-2021-40444. CVE-2021-40444 PoC

Sarcophagus. BSPWM (GruvBox Rice)

bspwmthemes. My bspwm awesome themes collection

ASWCrypter. An Bash&Python Script For Generating Payloads that Bypasses All Antivirus so far [FUD]

rce-finder. A tool to find good RCE

CVE-2017-0213. Fixed No Virus Manual Automatic Loader exe no zip because zip picks up the anti virus detector.

OSCP-Cheatsheets. OSCP Cheatsheets

filesmanager-python. TXT file handling system made in Python.

Linux-Kernel-Module-basic-explanation. Estudos sobre LKM - Linux Kernel Module.

consulta-cep. Consulta CEP em Python utilizando a API ViaCEP.

tomcter. 😹 Python project to bruteforce Apache Tomcat manager login with known-default credentials

waybackurls. Fetch all the URLs that the Wayback Machine knows about for a domain

OSCPRepo. A list of commands, scripts, resources, and more that I have gathered and attempted to consolidate for use as OSCP (and more) study material. Commands in 'Usefulcommands' Keepnote. Bookmarks and reading material in 'BookmarkList' CherryTree. Reconscan Py2 and Py3. Custom ISO building.

juumla. 🦁 Python project to identify and scan for vulnerabilities related to the Joomla CMS project. It scans for common misconfigurations and public vulnerabilities.

BotConsultasDiscord. base Bot Queries Discord Made to use API'S CPF, TEL ,CEP, etc...

discord_rich_lua. Discord Rich Lua, made to Show status on your discord profile