Francesco Soncina

PEzor. Open-Source Shellcode & PE Packer

rustbuster. A Comprehensive Web Fuzzer and Content Discovery Tool

x0rro. A PE/ELF/MachO Crypter for x86 and x86_64 Based on Radare2

crosser. A Reflected / Stored / DOM XSS Scanner based on Headless Chrome Node API via Puppeteer

nodebuster. DirBuster for Node.js

await-to-ts. http://blog.grossman.io/how-to-write-async-await-without-try-catch-blocks-in-javascript/

http-check. HTTP Header Analysis Vulnerability Tool

inspector-exploiter. Execute commands via Node.js debug port and inspector protocol

seh-exploits. Python

complex-ansible-example. Example of a complex Ansible deploy

zero-width-fingerprint-detection-extension. A browser extension to detect when zero-width characters are used to fingerprint cut/copied/pasted text.

evilginx2. Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

phra.github.io. SCSS

AggressorScripts. Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

PowerSploit. PowerSploit - A PowerShell Post-Exploitation Framework

bof-helper. Python Helper Utilities for SEH Overwrite Based Exploits

console-caller. Do you want to easily find out which line of your code is printing that thing? This is the right module for you!

Awesome-Asset-Discovery. List of Awesome Asset Discovery Resources

obfuscator. ollvm，base on llvm-clang 5.0.2, 6.0.1 , 7.0.1,8.0,9.0,9.0.1,swift-llvm-clang 5.0(waiting support swift obfuscator)

Wordpresscan. WPScan rewritten in Python + some WPSeku ideas

802_21. IEEE 802.21 experiment

gef. GEF - GDB Enhanced Features for exploit devs & reversers

graphql-apollo-react-chat. JavaScript

mingw-pe-resources-example. Based on https://bigcode.wordpress.com/2016/12/21/mingw-windows-icon-resource-example/

detection-rules. Rules for the Detection Engine in Elastic Security

SuperJumper. Java

Phantom-Evasion. Python AV evasion tool capable to generate FUD executable even with the most common 32 bit metasploit payload(exe/elf/dmg/apk)

radare2. UNIX-like reverse engineering framework and command-line toolset

Recon-AD. Recon-AD, an AD recon tool based on ADSI and reflective DLL’s

angular2-seed-advanced. An advanced Angular2 seed project with support for ngrx/store, ng2-translate, angulartics2, lodash, NativeScript (*native* mobile), Electron (Mac, Windows and Linux desktop) and more.

endlessh. SSH tarpit that slowly sends an endless banner

CS-BOFs. Collection of CobaltStrike beacon object files

key-fingerprint. Node.js library to easy calculate MD*, SHA*, etc fingerprint of a public/private key in HEX encoding.

loopback-angular2-boilerplate-OUTDATED. Example of webapp based on LoopBack, Gulp, JSPM, Angular2 & PostCSS

SharpMove. .NET Project for performing Authenticated Remote Execution

SharpRDP. Remote Desktop Protocol .NET Console Application for Authenticated Command Execution

sha1collisiondetection.js. Makefile

ysoserial. A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

metasploit2020-five-of-hearts. Metasploit CTF 2020 - Five of Hearts Writeup - RISC-V Buffer Overflow with NX and Canary

truffleHog. Searches through git repositories for high entropy strings and secrets, digging deep into commit history

krackattacks-test-ap-ft. Python

SharpChromium. .NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins.

UACME. Defeating Windows User Account Control

IntruderPayloads. A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

mimikatz. A little tool to play with Windows security

Awesome-Profile-README-templates. A collection of awesome readme templates to display on your profile

phra.

graphql-faker. 🎲 Mock or extend your GraphQL API with faked data. No coding required.

nmap. Nmap - the Network Mapper. Github mirror of official SVN repository.

base64-to-uint8array. Convert a base64 string to a Uint8Array in Node and the browser

odat. ODAT: Oracle Database Attacking Tool

pentest. :no_entry: offsec batteries included

SharpHound. The BloodHound C# Ingestor

Front-End-Checklist. 🗂 The perfect Front-End Checklist for modern websites and meticulous developers

awesome-security. A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.