Paul

awesome-sec-talks. A collected list of awesome security talks

awesome-windows-domain-hardening. A curated list of awesome Security Hardening techniques for Windows.

twittor. A fully featured backdoor that uses Twitter as a C&C server

API-dnsdumpster.com. (Unofficial) Python API for https://dnsdumpster.com/

HQLmap. (Deprecated) HQLmap, Automatic tool to exploit HQL injections

Shodan.io-mobile-app. Official repository for the Shodan.io mobile Application

CSRFT. A lightweight CSRF Toolkit for easy Proof of concept

DET. (extensible) Data Exfiltration Toolkit (DET)

crt.sh. (Unofficial) Python API for https://crt.sh

Shodan-Firefox-Addon. Shodan Firefox Add-on

osint-facebook-reset-password. Python util to retrieve full display name and profile picture from a single email address

skype-osint. Python OSINT Tool to retrieve information from Skype

SPIPScan. SPIP (CMS) Scanner for penetration testing purpose written in Python

API-EZTV.it. (Unofficial) Python API for the torrent website EZTV.it

metasearch-public. Stop searching for sample hashes on 10 different sites.

API-malwr.com. (Unofficial) Python API for https://malwr.com/

cybercrime-tracker.net. (Unofficial) Python API for cybercrime-tracker.net

go-http-monitor. A (dead-simple) Golang utility allowing you to monitor HTTP endpoints

API-InstagramLocation. Python OSINT Tool to retrieve pictures from a specific location using Instagram API

pepito. Finds sensitive stuff in your git repository by specifying terms to look for

Shodan-mattermost. Mattermost - Shodan Slash command

VNWA. Vulnerable Node.js Web Application to pratice with your pentesting skills

API-namechk.com. (Unofficial) Python API for http://namechk.com

HTTP-traceroute. HTTP-traceroute in Go

exploitdb-json-api. JSON API for ExploitDB Website

ransomware-tracker. (Unofficial) Python API for http://ransomwaretracker.abuse.ch/tracker/

SearchShodan. This is a basic example of how to search into Shodan using the ShodanAPI.

API-netcraft.com. (Unofficial) Python API for http://netcraft.com

API-checkusernames.com. (Unofficial) Python API for http://checkusernames.com

passphrase-wordlist. Passphrase wordlist and hashcat rules for offline cracking of long, complex passwords

XSS-Callback. A lightweight HTTP Server that exploits XSS victim's session automatically

SSLBlackList. (Unofficial) Python API for https://sslbl.abuse.ch/

SecLists. SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

WhatHashIsIt. # Deprecated # "What hash is it?" service allows you to identify the hashing functions used of your hash(es) based on their characteristics.

Social-Markdown. "Dillinger.io clone" allowing live concurrent editing.

TVShowsManager. Basic manager to download your TV Shows automatically with EZTV.it website.

recon-scan. Recon tool using Yatedo and Pipl

paulsec.github.io. Repository containing my portfolio

AIL-framework. AIL framework - Analysis Information Leak framework

API-HaveIBeenPwned. (Unofficial) Python API for HaveIBeenPwned Website

Python-plugins. Quick Python project with a simple Plugin architecture

what-is-this-browser. Python script that tells you what's the potential configuration behind a User-Agent

ESPloitV2. WiFi Keystroke Injection Tool designed for an Atmega 32u4/ESP8266 Paired via Serial (Cactus WHID Firmware). Also features Serial, HTTP, and PASV FTP exfiltration methods and an integrated Credential Harvester Phishing tool called ESPortal.

drupal-enum-users. (Python) Quick script to enumerate users on a Drupal instance

censysio. Censysio Python wrapper

markovobfuscate. Python library and tools to obfuscate data based on Markov models built off the same data

burito. # Deprecated # Burito, Hydra-like tool to audit Web application using forms containing server-side generated params.

theHarvester. E-mail, subdomain and people names harvester

urh. Universal Radio Hacker: investigate wireless protocols like a boss

shellpot-nodejs. Honeypot written in Node.js for the Shellshock vulnerability

node-ip-info. Retrieves information about a specific IP

API-ShouldIChangeMyPassword. (Unofficial) Python API for ShouldIChangeMyPassword Website

gophish. Open-Source Phishing Toolkit

webhooks. :fishing_pole_and_fish: Webhook receiver for GitHub, Bitbucket, GitLab, Gogs

Empire. Empire is a PowerShell and Python post-exploitation agent.