Luke Stephens (hakluke)

how-to-exit-vim. Below are some simple methods for exiting vim.

hakrawler. Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application

hakrevdns. Small, fast tool for performing reverse DNS lookups en masse.

weaponised-XSS-payloads. XSS payloads designed to turn alert(1) into P1

hakoriginfinder. Tool for discovering the origin host behind a reverse proxy. Useful for bypassing cloud WAFs!

haktrails. Golang client for querying SecurityTrails API data

hakip2host. hakip2host takes a list of IP addresses via stdin, then does a series of checks to return associated domain names.

hakcheckurl. Takes a list of URLs and returns their HTTP response codes

bug-bounty-standards. A list of edge cases that occur in bug bounty programs, conversations on how they should be handled. The goal is to standardise the way that specific situations are handled in bug bounties.

haklistgen. Turns any junk text into a usable wordlist for brute-forcing.

hakscale. Distribute ordinary bash commands over many systems

haktldextract. Extract domains/subdomains from URLs en masse

hakfindinternaldomains. Feed it a list of subdomains, it will resolve them and tell you which ones are internal

hakcron. Easily schedule commands to run multiple times at set intervals (like a cronjob, but with one command)

hakq. A basic golang server/client for distributing tasks over multiple systems.

hakrevshell. Shell

dnstrace. DNS resolution tracing tool

hakcertstream. Basic implementation of certstream to print new subdomains and domains

hakstore. Go

hakluke.

Internal-Pentest-Playbook. Internal Network Penetration Test Playbook

hakaxfr. Attempt zone transfers on domains

haksecuritytxt. Takes a list of domains as the input, checks if they have a security.txt, outputs the results.

hakcsp. Return domains in CSP headers in http response

hakjoke. Gets joke from icanhazdadjoke.com, prints it

payload-generator. PHP

XSS. Xss payloads

----svg-onload-alert---. jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

theHarvester. E-mails, subdomains and names Harvester - OSINT

helloworlds. hello world in different languages

hacks. Repo of useful scripts

hakawshostnames. Generate a list of all AWS hostnames

Markdown-XSS-Payloads. XSS payloads for exploiting Markdown syntax

tldextract. Extract root domain, subdomain name, and tld from a url, using the Public Suffix List.

WindowsExploits. Windows exploits, mostly precompiled.

hakurlencode. (en|de)code urls from the CLI

SecLists. SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

nuclei-templates. Community curated list of template files for the nuclei engine to find security vulnerability and fingerprinting the targets.

templates. Repository to house markdown templates for researchers

Wappalyzer. Cross-platform utility that uncovers the technologies used on websites.

gzipsplit. split lines of text into multiple gzip files

gh-dork. Github dorking tool

copy-excel-paste-markdown. Copy a table in Excel (or other spreadsheet programs) and paste it as a Markdown table

webanalyze. Port of Wappalyzer (uncovers technologies used on websites) in Go to automate scanning.

FakeKoala.

fabric. fabric is an open-source framework for augmenting humans using AI.

assetnote. Push notifications for passive DNS data

anew. A tool for adding new lines to files, skipping duplicates