Ivan Šincek

penetration-testing-cheat-sheet. Work in progress...

php-reverse-shell. PHP shells that work on Linux OS, macOS, and Windows OS.

wifi-penetration-testing-cheat-sheet. Work in progress...

android-penetration-testing-cheat-sheet. Work in progress...

ios-penetration-testing-cheat-sheet. Work in progress...

invoker. Penetration testing utility and antivirus assessment tool.

powershell-reverse-tcp. PowerShell scripts for communicating with a remote host.

forbidden. Bypass 4xx HTTP response status codes and more. The tool is based on Python Requests, PycURL, and HTTP Client.

malware-apk. As a bug hunter, are your bug bounty reports getting rejected because you don't use a "malicious" Proof of Concept (PoC) app to exploit the vulnerabilities? I've got you covered!

evil-twin. Learn how to set up a fake authentication web page on a fake WiFi network.

php-ransomware. PHP ransomware that encrypts your files, as well as file and directory names.

keylogger. Windows OS keylogger with a hook mechanism (i.e. with a keyboard hook procedure).

java-reverse-tcp. JAR, Java, and JSP shells that work on Linux OS, macOS, and Windows OS.

chat-app. Multithreading TCP server and client communicating over TCP/IP - Windows Forms Application.

xss-catcher. Simple API for storing all incoming XSS requests and various XSS templates.

phishing-mobile-app. Phishing mobile application made in React Native for both Android and iOS devices.

chad. Search Google Dorks like Chad. / Broken link hijacking tool.

dns-exfiltrator. Exfiltrate data with DNS queries. Based on CertUtil and NSLookup.

secure-website. Secure website with a registration, sign in, session management, and CRUD controls.

file-scraper. Scrape files for sensitive information, and generate an interactive HTML report. Based on Rabin2.

scrapy-scraper. Web crawler and scraper based on Scrapy and Playwright's headless browser.

nagooglesearch. Not another Google searching tool.

metagoofeel. Web crawler and downloader based on GNU Wget.

amounts. Generate a wordlist to fuzz amounts or any other numerical values.

wordlist-extender. Extend wordlist by appending digits and special characters to each word.

jwt-bf. Brute force a JWT token. Script uses multithreading.

memory-dumper. Dump a process memory and extract data based on regular expressions.

websocket-bf. Brute force a REST API query through WebSocket. Based on cURL.

domain-extractor. Extract valid or partially valid domain names and IPs from malicious or invalid URLs.

property-lister. Extract and convert property list files from SQLite database files and from other property list files.

malware-droppers. Custom malware droppers written in multiple languages.

dnsrecon-chunked. Brute force subdomains in multiple smaller iterations. Based on DNSRecon.

file-shredder. PowerShell script for shredding files.

pre-master-secret-key. Set up all you need to capture pre-master secret keys to decrypt SSL in Wireshark.

bot-safe-agents. A library for fetching a list of bot-safe user agents.

browser-extension-automation. Run a browser extension in a sandboxed web browser and without any fear of corrupting or loosing your real data.

transporter. Send packets through raw sockets.

auto-recon. Not another auto-reconnaissance framework.

solidity-learning. Work in progress...

ivan-sincek. My profile info.

unquoted-service-paths. List unquoted service paths and start, stop, or restart services as needed.

uninstall-msi-products. Uninstall a specific or all MSI products.

css-dictionary-attack. Example on how to steal information with CSS from web forms.

nagooglesearch-playwright. Not another Google searching tool.

threat-modeling-agent-skills. Easy-to-use, high-efficiency threat modeling agent skills.