更新时间 | 项目名称 | 版本 | 更新内容 |
---|---|---|---|
2023-12-14 18:08:32 | FreeRDP | 2.11.4 | Notworthy changes: * fix a typo in un icode commit (#9652) |
2023-12-14 13:04:05 | frp | v0.53.0 | ### Features * The new command line p arameter --strict_config has been adde d to enable strict configuration valid ation mode. It will throw an error for unknown fields instead of ig |
2023-12-14 12:42:12 | Pillager | AutoBui ld |
|
2023-12-14 08:33:38 | PyWxDump | v2.3.11 | [Auto Release] Update PyWxDump to ref s/tags/v2.3.11 |
2023-12-13 16:59:53 | faker | v21.0.0 | See . |
2023-12-13 14:49:19 | WeChatMsg | v0.2.8 | # 新增功能 * 支持导出语音 #76 * 支持 导出引用消息 * 新增导出到txt文档 * 新增 自主选择导出类型 # 优化 * 移除对模拟器 数据库的支持 * 修复图片或视频显示不全的 问题 #126 * html页面输入页码可以回车跳 转,跳转后自动滚动到页面顶部。#114 * 联 系人按照最新聊天时间排序 #122 * 年度报 告词云图按照发送和接收分别处理 # |
2023-12-13 12:32:04 | locust | 2.20.0 | ## What's Changed * Unable to modify custom parameters from the modern UI b y @andrewbaldwin44 in https://github.c om/locustio/locust/pull/2491 * Further relax FastHttpUser's host ch |
2023-12-13 05:17:50 | goproxy | v14.1 | 1、sps/socks新增--udp-compat参数,用 于打开socks5 udp功能的兼容模式,兼容某 些不遵守socks5 RFC 1928 规范的socks5客 户端。 2、sps/socks新增--udp-gc参数,用 来设置UDP最大空闲时间,超过这个时间,UD P会被释放。 |
2023-12-13 00:42:41 | CTFd | 3.6.1 | # 3.6.1 / 2023-12-12 Security - F ix an issue where users could bypass S core Visibility and see a user's score /place when not allowed by Admins Ge neral - Add Slovak, Japanes |
2023-12-12 21:08:39 | dbeaver | 23.3.0 | Changes since 23.2.5: - Security: da tabase drivers were updated due to sec urity reasons: DB2, Google BigQuery, A thena, and YugabyteDB - SQL Editor: - Autocompletion of column name |
2023-12-11 16:47:07 | codeql-cli-binari es |
v2.15.4 | ### Improvements - Parallelism in the evaluator has been improved, resultin g in faster analysis when running with many threads, particularly for large databases. For more informati |
2023-12-11 06:31:19 | ImageMagick | 7.1.1-2 3 |
## What's Changed * configure.ac: Fix bashism by @thesamesam in https://git hub.com/ImageMagick/ImageMagick/pull/6 931 * Fix zstd not being listed under GetMagickDelegates() by @valg |
2023-12-10 04:25:47 | PEASS-ng | 2023121 0-89d560 ba |
|
2023-12-09 13:37:47 | Online_tools | 0.5.0 | ### 增加新工具 - yakit - SBSCAN ### 更新了什么 这个版本更新很多功能,下面我 就说一下改动比较大的一些功能 - 自定义工 具添加 - 改成了点击图标启动工具,下载工 具,更新工具 - 添加自定义界面的设置 - 全局快捷键工具的搜索,可以按alt+d键快速 弹出 - 下载卸载更新添加自动刷新界面 - 代码的运行优化 |
2023-12-09 13:25:37 | nuclei | v3.1.1 | ## What's Changed * Added support fo r arbitrary string input for TLS SNI a nnotation by @jimen0 in https://github .com/projectdiscovery/nuclei/pull/4462 * Fixed panic + refactor hea |
2023-12-09 03:45:36 | gshark | v1.4.0 | ## Fixed * go-github 组件升级 * GitHu b 扫描支持系统代理 |
2023-12-08 23:48:02 | containerd | v1.7.11 | Welcome to the v1.7.11 release of con tainerd! The eleventh patch release fo r containerd 1.7 contains various fixe s and updates including one security i ssue. ### Notable Updates * * |
2023-12-08 12:51:55 | Umi-OCR | release /2.0.1 |
### v2.0.1 ŠŤ┤Šľ░ňćůň«╣´╝Ü - ŃÇ ÉHTTPŠÄąňĆúšöĘŠłĚŠ│ĘŠäĆŃÇĹ Ú珊ľ░Ŕ «żŔ«íń║ćHTTPŠÄąňĆúŃÇéňůüŔ«ŞšťüšĽąňĆéŠ Ľ░´╝îňůüŔ«ŞŔ«żň«ÜŠ«ÁŔÉŻňÉłň╣ÂŃÇéŔžü ŃÇé - ňĹŻń╗ĄŔíîňó×ňŐáŠîçń╗Ą-->ňĺî--> >´╝ |
2023-12-08 12:29:28 | rengine | v2.0.2 | ## What's Changed * Added tooltip tex t to dashboard total vulnerabilities t ooltip by @luizmlo in https://github.c om/yogeshojha/rengine/pull/1029 * ops( uninstall.sh): add missing vo |
2023-12-08 10:59:45 | mitaka | v1.4.1 | ## What's Changed * chore(deps): upda te actions/setup-node action to v4 by @renovate in https://github.com/ninose ki/mitaka/pull/780 * v6.0.1 by @ninose ki in https://github.com/nino |
2023-12-08 03:47:17 | safeline | v3.15.3 | ### 修复 - 修复 403 拦截页面没有展示 拦截页面附加说明的问题 |
2023-12-07 11:44:20 | TranSec | transec os1.0 |
tranOS is iso tranOS_OVA is ova The t xt file contains hash values for iso a nd ova |
2023-12-06 03:30:59 | afrog | v2.9.5 | 【新增】-cyberspace / -cs 网络测绘空 间搜索功能,支持 ZoomEye,命令实例:-cs zoomeye -q "app:'Yonyou NC httpd'" -q c 200 详情见 wiki 【优化】PoC GitLab p ublic snippets 漏洞等级由 INFO 改为 HI GH ------------------------- |
2023-12-05 10:23:50 | WebGoat | v2023.8 | ## Version v2023.8 ### 🚀 New functio nality - Consistent environment values and url references (#1677) - Show dir ectly requested file in requests overv iew - Show creating time in fi |
2023-12-05 09:21:33 | trivy | v0.48.0 | ## ⚡Release highlights and summary⚡ 👉 https://github.com/aquasecurity/tr ivy/discussions/5724 ## Changelog * f2 aa9bf3e chore(deps): bump sigstore/cos ign-installer from 4a861528be5e6 |
2023-12-04 15:00:34 | ysomap | v0.1.5 | - fix shiro exploit @BBQM1911 #54 v0. 1.5 2023.12.04 auto-generated by githu b actions |
2023-12-03 18:20:26 | pyinstxtractor | 2023.12 | Bump release version |
2023-12-03 09:23:20 | Ladon | v12.0 | Ladon 12.0 20231201 [+]DomainLog Doma inUserIP 远程查询 域用户、IP [u]LoginL og 4624成功日志 域用户、域名、登陆IP / all 导出全部日志 原始数据 LoginLog 用 户名 LoginLog 用户名 记录数 |
2023-12-03 06:18:42 | Viper | 2023-12 -03-13-4 4-27 |
### Bugfix - Fix https://github.com/F unnyWolf/Viper/issues/188 - Fix https: //github.com/FunnyWolf/Viper/issues/18 7 - Fix https://github.com/FunnyWolf/V iper/issues/186 |
2023-11-30 14:40:51 | grype | v0.73.4 | ### Additional Changes - bump to syft v0.98.0 in quality gate tests @westo nsteimel] - update syft to v0.98.0; go mod tidy @spiffcs] **** |
提交时间 | 项目名称 | 更新内容 |
---|---|---|
2023-12-15 00:31:19 | PoC-in-GitHub | Auto Update 2023/12/15 00:31:19 |
2023-12-15 00:30:28 | sliver | Merge pull request #1506 from BishopFox/docs/next F ix dark mode docs |
2023-12-15 00:00:02 | free | updated_at 12-15 08:00 |
2023-12-14 23:13:15 | CTFd | Merge pull request #2442 from CTFd/update-core-beta * Update core-beta to latest version * Include meta tag & title customization * Fix issue with private user pages in teams mode |
2023-12-14 22:18:37 | syft | chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.2 to 0.8.0 (#2413) |
2023-12-14 22:00:59 | WebGoat | Fix typos in texts. |
2023-12-14 21:44:41 | PocOrExp_in_Githu b |
update 2023-12-15 05:44:41 |
2023-12-14 20:30:02 | logging-log4j2 | Javadoc |
2023-12-14 19:59:30 | ImHex | fix: Format security error |
2023-12-14 19:58:50 | john | autotools: stop linking against the OpenCL library Start using dynamic OpenCL binding. And continue bui lding a non-OpenCL binary for users who don't have O penCL installed. Signed-o |
2023-12-14 18:59:28 | neuvector | Merge pull request #1128 from williamlin-suse/main NVSHAS-8247: Less cross-check when processing CRD (i ncrease the chann… |
2023-12-14 18:08:41 | metasploit-framew ork |
Bump version of framework to 6.3.48 |
2023-12-14 16:35:59 | dbeaver | Merge branch 'devel' of https://github.com/dbeaver/ dbeaver into devel |
2023-12-14 16:29:09 | PST-Bucket | goby: Update to version 2.8.5 |
2023-12-14 15:33:04 | WeChatMsg | 修改部分ui |
2023-12-14 14:56:55 | containerd | Merge pull request #9514 from containerd/dependabot /github_actions/actions/upload-artifact-3 build(deps ): bump actions/upload-artifact from 1 to 3 |
2023-12-14 14:31:01 | PyWxDump | 添加简单教程 |
2023-12-14 13:17:39 | v2rayA | debian: add loong64 and remove ppc64el armv7/8 |
2023-12-14 13:05:39 | FreeRDP | [proxy,modules] explicitly build shared libraries T he proxy modules must always be shared libraries. To have the proper system extension, use keyword SHARE D instead of MOUDLE |
2023-12-14 12:54:03 | frp | update doc (#3844) |
2023-12-14 12:40:57 | Pillager | Update README.md |
2023-12-14 12:36:40 | v2rayfree | update |
2023-12-14 11:53:49 | sqlmap | Minor update |
2023-12-14 11:10:49 | volatility3 | Merge pull request #1057 from eve-mem/linux_fix_pst ree Linux: Update pslist to fix pstree |
2023-12-14 09:52:08 | Umi-OCR | 预备:PDF识别 |
2023-12-14 09:21:48 | Library-POC | Update README.md |
2023-12-14 08:45:46 | afrog | update |
2023-12-14 08:21:09 | murphysec | ci(gitlab): Remove unused ci image |
2023-12-14 07:50:42 | HackerPermKeeper | Update README.md |
2023-12-14 07:48:20 | DIE-engine | Update module: XDataConvertorWidget 2023-12-14 |
2023-12-14 07:32:01 | appshark | Merge pull request #64 from firmianay/dev3 add runt imeSDK |
2023-12-14 07:29:24 | All-Defense-Tool | 更新v3.1 |
2023-12-14 02:43:58 | safeline | feat: update 5xx page |
2023-12-14 01:04:32 | rustdesk | New term added (#6673) * Update es.rs New terms add ed * Update es.rs mistype correction * Update es.rs New term added |
2023-12-14 00:55:11 | ImageMagick | check for corrupt DJVU images (https://github.com/I mageMagick/ImageMagick/security/advisories/GHSA-wv9p -78jx-g7fv) |
2023-12-13 22:50:11 | grype | chore(deps): bump github.com/charmbracelet/bubblete a (#1635) Bumps from 0.24.2 to 0.25.0. - - --- up dated-dependencies: - dependency-name: github.com/ch armbracelet/bubbletea dep |
2023-12-13 18:33:26 | anti-AD | Auto renew the anti-AD list. |
2023-12-13 16:59:25 | faker | Bump version: 20.1.0 → 21.0.0 |
2023-12-13 14:29:08 | iDefender | update |
2023-12-13 12:35:23 | locust | update autogenerated changelog |
2023-12-13 12:07:31 | trivy | refactor(purl): use pub from package-url (#5784) |
2023-12-13 11:37:30 | audacity | disable FLAC export when no tracks are present... . .. and remove the hiddenfilemenu containing a duplic ate entry. |
2023-12-13 09:23:41 | gshark | Merge pull request #188 from madneal/dependabot/go_ modules/server/github.com/mojocn/base64Captcha-1.3.6 Bump github.com/mojocn/base64Captcha from 1.3.1 to 1.3.6 in /server |
2023-12-13 07:28:12 | kube-bench | build(deps): bump golang from 1.21.3 to 1.21.5 (#15 34) Bumps golang from 1.21.3 to 1.21.5. --- updated- dependencies: - dependency-name: golang dependency-t ype: direct:production up |
2023-12-13 07:14:03 | ChatGPT-Shortcut | perf(comment): optimize logic and performance in th e comment component |
2023-12-12 23:55:31 | MemProcFS | Version 5.8.19 |
2023-12-12 15:45:35 | clair | cmd: annotate fake key for gitleaks This file appar ently has CRLF line endings, and I don't recall why. Odd. Signed-off-by: Hank Donnay |
2023-12-12 11:32:16 | all-in-one-v2 | fix await |
2023-12-12 07:28:48 | nemo_go | Update: 优化指纹任务 |
2023-12-12 05:42:04 | SmsForwarder | 新增:自动任务·快捷指令 —— 通道推送动作(开发中) |
2023-12-12 05:11:14 | vulnerability | CVE-2023-6655 |
2023-12-12 03:03:35 | Vulhub-Reproduce | 更新漏洞 |
2023-12-12 03:02:26 | Vulnerability-Wik i |
更新漏洞 |
2023-12-11 16:43:38 | codeql-cli-binari es |
Update changelog for 2.15.4 |
2023-12-11 15:00:07 | subfinder | Merge pull request #1076 from projectdiscovery/depe ndabot/go_modules/v2/dev/github.com/projectdiscovery /retryablehttp-go-1.0.39 |
2023-12-11 08:09:44 | Mobile-Security-F ramework-MobSF |
update pktool to 2.9.1 (#2304) |
2023-12-11 08:08:48 | Awesome-Redteam | update info gathering |
2023-12-11 07:06:12 | nuclei | Merge pull request #4481 from projectdiscovery/depe ndabot/go_modules/dev/github.com/projectdiscovery/fa stdialer-0.0.48 |
2023-12-11 02:48:11 | 404StarLink | weekly update at 2023-12-11 |
2023-12-11 01:27:56 | FrameVul | Update README.md |
2023-12-10 07:08:12 | ctf-archives | 0CTF chals |
2023-12-10 00:50:46 | ThinkAdmin | 修改 Excel.js 数据导出参数 |
2023-12-09 15:00:53 | Online_tools | 0.5.0公测版 |
2023-12-08 12:20:21 | rengine | Merge pull request #1086 from yogeshojha/fixes-for- tool-arsenal fix(tool_arsenal): incorrect regex vers ion numbers |
2023-12-08 10:58:41 | mitaka | v1.4.1 |
2023-12-08 09:52:54 | Elkeid | FIXME: possible crash due to resched triggered by p ut_files_struct() When parent process is exiting, th e last put_files_struct() would try to drop all file s which triggers a resche |
2023-12-08 07:39:47 | Viper | update version 2023-12-07 |
2023-12-08 01:55:29 | TranSec | Update README.md |
2023-12-07 17:16:36 | vulhub | Merge pull request #477 from vulhub/ofbiz-cve-2023- 49070 |
2023-12-07 15:12:25 | awesome-chatgpt-z h |
add intel-extension-for-transformers |
2023-12-07 14:34:05 | FingerprintHub | Auto Update FingerPrint [Thu Dec 7 14:34:05 UTC 202 3] 🤖 |
2023-12-07 14:13:43 | HKEcho_Nacos | Update README.md |
2023-12-07 02:33:06 | Scanners-Box | YOU can donate with Buy me a coffee now |
2023-12-06 07:45:48 | jdwp-codeifier | 修改README |
2023-12-06 04:46:58 | beef | Merge branch 'dependabot/bundler/rdoc-6.6.1' |
2023-12-05 19:05:45 | RsaCtfTool | update dixon.py |
2023-12-04 15:39:00 | ThunderSearch | fix zoomeye host_search |
2023-12-04 14:55:41 | ysomap | update version |
2023-12-04 12:47:40 | HFish | Update webinstall.sh |
2023-12-04 07:10:47 | HackerMind | Update 2.0 version:peach: |
2023-12-04 03:25:31 | arthas | fix typo (#2746) |
2023-12-04 01:13:57 | ObserverWard | Merge pull request #214 from 0x727/dependabot/cargo /serde-1.0.193 Bump serde from 1.0.190 to 1.0.193 |
2023-12-03 18:19:07 | pyinstxtractor | Mention support for 6.1.0, 6.2.0 |
2023-12-03 12:36:45 | dirsearch | Fixing Dockerfile python version |
2023-12-03 09:17:35 | Ladon | Add files via upload |
2023-12-03 09:13:43 | K8tools | Add files via upload |
2023-12-01 17:44:24 | wpscan | Merge pull request #1820 from wpscanteam/dfs Update s DFs |
2023-11-30 12:31:13 | Komo | Update requirement.txt |
2023-11-30 09:43:04 | Awesome-POC | 更新漏洞 |
2023-11-30 08:31:33 | VolatilityPro | Update README.md |
2023-11-30 03:59:12 | jar-analyzer-gui | Update README.md |
项目名称 | 版本 | 项目描述 |
---|---|---|
wordpress | AWD靶机 | |
AWDDocker | 标准化AWD靶场Docker | |
20190511_awd_dock er |
2019 年 5 月 11 日防灾科技学院 “应急挑战杯” 大学生网络安全邀 请赛 AWD 靶机题目。 |
|
AWD_CTF_Platform | 一个简单的AWD训练平台 | |
Liaoning-provinci al-competition-tar get-1 |
第三届辽宁省ctf线下awd靶机1web | |
awd-platform | platform for awd |
项目名称 | 版本 | 项目描述 |
---|---|---|
AoiAWD | AoiAWD-专为比赛设计,便携性好,低权限运行的EDR系统。 | |
k4l0ng_WAF | A broute detect WAF by PHP using to AWD | |
CTF-WAF | 针对CTF线下赛的通用WAF,日志审计功能。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Prepare-for-AWD | AWD攻防赛脚本集合 | |
AWD-Predator-Fram ework |
AWD攻防赛webshell批量利用框架 | |
awd_attack_framew ork |
awd攻防常用脚本+不死马+crontab+防御方法 |
项目名称 | 版本 | 项目描述 |
---|---|---|
JJUCTF_V2.0 | JJU网络安全靶场实训平台 | |
H1ve | 1.1.3 | An Easy / Quick / Cheap Integrated Platform |
Cardinal | v0.7.3 | CTF🚩 AWD (Attack with Defense) 线下赛平台 / AWD platform - 欢 迎 Star~ ✨ |
CTF_AWD_Platform | CTF 攻防对抗平台 | |
GZCTF | v0.17.6 | The GZ::CTF project, an open source CTF platform. |
MarsCTF | V1.2.1 | Vue+Springboot开发的CTF学习平台,提供动态靶机、学习模块、write up模块等等CTF平台的核心功能。提供docker版本 |
项目名称 | 版本 | 项目描述 |
---|---|---|
breakautokey | breakautokey |
项目名称 | 版本 | 项目描述 |
---|---|---|
CTF-RSA-tool | a little tool help CTFer solve RSA problem | |
RSA | ||
rsa-wiener-attack | A Python implementation of the Wiener attack on RSA public-key encryption scheme. |
|
RsaCtfTool | RSA attack tool (mainly for ctf) - retrieve private key from w eak public key and/or uncipher data |
项目名称 | 版本 | 项目描述 |
---|---|---|
ImHex | v1.31.0 | 🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM. |
项目名称 | 版本 | 项目描述 |
---|---|---|
CTFCrackTools | 4.0.7 | China's first CTFTools framework.**国内首个CTF工具框架,旨在 帮助CTFer快速攻克难关 |
Ciphey | 5.14.0 | ⚡ Automatically decrypt encryptions without knowing the key o r cipher, decode encodings, and crack hashes ⚡ |
CyberChef | v10.5.2 | The Cyber Swiss Army Knife - a web app for encryption, encodin g, compression and data analysis |
TomatoTools | v1.0.2 | TomatoTools 一款CTF杂项利器,支持36种常见编码和密码算法的加密 和解密,31种密文的分析和识别,支持自动提取flag,自定义插件等。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
QrScan | v2.9.0 | 离线批量检测图片是否包含二维码以及识别二维码 |
项目名称 | 版本 | 项目描述 |
---|---|---|
PuzzleSolver | v1.0.1- beta |
一款专门为CTF比赛设计的拼图工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
CTF_Hacker-Tools | ||
qsnctf-python | 0.0.8.1 0 |
青少年CTF的Python包,方便大家调用一些CTF常用功能。 |
CTF-Tools | v1.3.7 | 一款Python+Pyqt写的CTF编码、解码、加密、解密工具。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
项目名称 | 版本 | 项目描述 |
---|---|---|
JavaDecompileTool -GUI |
V1.2 | Java Decompile Tool GUI-JAVA反编译工具(界面版) |
CodeReviewTools | v1.31 | 通过正则搜索、批量反编译特定Jar包中的class名称 |
项目名称 | 版本 | 项目描述 |
---|---|---|
stegosaurus | 1.0 | A steganography tool for embedding payloads within Python byte code. |
python-uncompyle6 | 3.9.0 | A cross-version Python bytecode decompiler |
pyinstxtractor | 2023.12 | PyInstaller Extractor |
项目名称 | 版本 | 项目描述 |
---|---|---|
DIE-engine | 3.08 | DIE engine |
项目名称 | 版本 | 项目描述 |
---|---|---|
ctf-wscan | 在kingkaki的项目上进行了修改,改为单线程,可以在任意目录下执行 ,对重复的请求进行了过滤 |
项目名称 | 版本 | 项目描述 |
---|---|---|
http://www.ctftools.com/ | ||
apachecn-ctf-wiki | ||
CTFd | 3.6.1 | CTFs as you need them |
ctf-tools | CTF 工具集合 | |
BerylEnigma | 1.15.0 | ffffffff0x team toolset for penetration testing, cryptography research, CTF and daily use. |
CTFd_chinese_CN | v1.2.0 | 对CTFd平台各版本的汉化记录。key:中文、汉化、翻译、chinese、CN 、CTFd |
CTF-Note | CTF笔记:该项目主要记录CTF知识、刷题记录、工具等。 | |
ctf_ics_traffic | 工控CTF比赛工具,各种网络数据包处理脚本 | |
CTF-QuickStart | 源仓库存档 | |
CTFtools-wiki | 【Hello CTF】录常用 / 优秀 的CTF工具项目及其文档,一个对各阶段C TFer都很友好的工具仓库,让所有的工具都发挥作用! |
|
SecToolKit | Cybersecurity tool repository / Wiki 收录常用 / 前沿 的CTF和渗 透工具以及其 官方/使用 文档,致力于让每个工具都能发挥作用ww,不 管你是萌新还是领域从业者希望你都能在这里找到适合你的工具或者获得 一定的启发。 |
|
CTF-Tools | 渊龙Sec安全团队CTF&AWD工具箱 | |
ctf-archives | CTF Archives: Collection of CTF Challenges. |
项目名称 | 版本 | 项目描述 |
---|---|---|
appshark | v0.1.2 | Appshark is a static taint analysis platform to scan vulnerabi lities in an Android app. |
项目名称 | 版本 | 项目描述 |
---|---|---|
r0capture | 安卓应用层抓包通杀脚本 |
项目名称 | 版本 | 项目描述 |
---|---|---|
myscan | myscan 被动扫描 | |
DarkAngel/ | ||
xray | 1.9.11 | 一款完善的安全评估工具,支持常见 web 安全问题扫描和自定义 poc |
Fvuln | Fvuln-1 .4.9 |
F-vuln(全称:Find-Vulnerability)是为了自己工作方便专门编写的 一款自动化工具,主要适用于日常安全服务、渗透测试人员和RedTeam红 队人员,它集合的功能包括:存活IP探测、开放端口探测、web服务探测 、web漏洞扫描、smb爆破、ssh爆破、ftp爆破、mssql爆破等其他数据库 爆破工作以及大量web漏洞检测模块。 |
EasyPen | EasyPen is a GUI program which helps pentesters do target disc overy, vulnerability scan and exploitation |
|
nuclei | v3.1.1 | Fast and customizable vulnerability scanner based on simple YA ML based DSL. |
QingTing | v0.3 | 蜻蜓安全一个安全工具编排平台,可以自由编排你的工具流,集成108款 工具,包括xray、nmap、awvs等;你可以将喜欢的工具编排成一个场景,快 速打造适合自己的安全工作台~ |
NextScan | v1.2.0 | 飞刃是一套完整的企业级黑盒漏洞扫描系统,集成漏洞扫描、漏洞管理 、扫描资产、爬虫等服务。 拥有强大的漏洞检测引擎和丰富的插件库, 覆盖多种漏洞类型和应用程序框架。 |
POC-bomber | POC-bom ber-for- Redteam- v3.0.0 |
利用大量高威胁poc/exp快速获取目标权限,用于渗透和红队快速打点 |
w13scan | Passive Security Scanner (被动式安全扫描器) | |
afrog | v2.9.5 | A Security Tool for Bug Bounty, Pentest and Red Teaming. |
vulmap | v0.9 | Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫 描, 并且具备漏洞验证功能 |
项目名称 | 版本 | 项目描述 |
---|---|---|
code-inspector | 0.2-bet a |
JavaWeb漏洞审计工具,构建方法调用链并模拟栈帧进行分析 |
jar-analyzer-gui | 1.1 | 建议使用新版:https://github.com/jar-analyzer/jar-analyzer |
codeql-cli-binari es |
v2.15.4 | Binaries for the CodeQL CLI |
CodeQLpy | CodeQLpy是一款基于CodeQL实现的半自动化代码审计工具,目前仅支持 java语言。实现从源码反编译,数据库生成,脆弱性发现的全过程,可 以辅助代码审计人员快速定位源码可能存在的漏洞。 |
|
JVWA | java 代码审计学习靶场 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Kunlun-M | v2.6.5 | KunLun-M是一个完全开源的静态白盒扫描工具,支持PHP、JavaScript 的语义扫描,基础安全、组件安全扫描,Chrome Ext\Solidity的基础扫 描。 |
murphysec | v3.1.1 | An open source tool focused on software supply chain security. 墨菲安全专注于软件供应链安全,具备专业的软件成分分析(SCA)、 漏洞检测、专业漏洞库。 |
fortify | fortify内置规则加密破解 |
项目名称 | 版本 | 项目描述 |
---|---|---|
python_code_audit | python 代码审计项目 | |
python_sec | python安全和代码审计相关资料收集 resource collection of python security and code review |
项目名称 | 版本 | 项目描述 |
---|---|---|
web-brutator | Fast Modular Web Interfaces Bruteforcer | |
thc-hydra-windows | v9.1 | The great THC-HYDRA tool compiled for Windows |
ssb | v0.1.1 | Secure Shell Bruteforcer — A faster & simpler way to brutefor ce SSH server |
SNETCracker | 1.0.201 90715 |
超级弱口令检查工具是一款Windows平台的弱口令审计工具,支持批量 多线程检查,可快速发现弱密码、弱口令账号,密码支持和用户名结合进 行检查,大大提高成功率,支持自定义服务端口和字典。 |
WebCrack | WebCrack是一款web后台弱口令/万能密码批量检测工具,在工具中导入 后台地址即可进行自动化检测。 |
|
john | John the Ripper jumbo - advanced offline password cracker, whi ch supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs |
|
thc-hydra | v9.5 | hydra |
项目名称 | 版本 | 项目描述 |
---|---|---|
Ingram | v2.0.0 | 网络摄像头漏洞扫描工具 |
Dude |
项目名称 | 版本 | 项目描述 |
---|---|---|
Godscan | Godscan | Godscan 是一款python编写的具有图形化界面的漏洞检测框架,可以之 定义漏洞检测 poc ,主要是帮助安全测试者,更好的去记录和整理历史 漏洞,以便更好的进行漏洞检测,提高工作效率! |
pocassist | 1.0.5 | 傻瓜式漏洞PoC测试框架 |
pocsuite3 | v2.0.5 | pocsuite3 is an open-sourced remote vulnerability testing fram ework developed by the Knownsec 404 Team. |
Gr33k | 图形化漏洞利用集成工具 | |
kunpeng | 2019052 7 |
kunpeng是一个Golang编写的开源POC框架/库,以动态链接库的形式提 供各种语言调用,通过此项目可快速开发漏洞检测类的系统。 |
FrameScan-GUI | v1.4.3 | FrameScan-GUI 一款python3和Pyqt编写的具有图形化界面的cms漏洞检 测框架。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
wxapkg | v1.5.0 | 微信小程序反编译工具,.wxapkg 文件扫描 + 解密 + 解包工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
code6 | 1.6.4 | 码小六 - GitHub 代码泄露监控系统 |
gshark | v1.4.0 | Scan for sensitive information easily and effectively. |
项目名称 | 版本 | 项目描述 |
---|---|---|
Jiraffe | v2.0.6 | One stop place for exploiting Jira instances in your proximity |
WeblogicScan | Weblogic一键漏洞检测工具,V1.5,更新时间:20200730 | |
Artillery | v1.0_20 220519 |
JAVA 插件化漏洞扫描器,Gui基于javafx。POC 目前集成 Weblogic、T omcat、Shiro、Spring等。 |
weblogic-infodete ctor |
0.2.4 | woodpecker框架weblogic信息探测插件 |
项目名称 | 版本 | 项目描述 |
---|---|---|
MYExploit | V2.0.4 | OAExploit一款基于产品的一键扫描工具。 |
OA-EXPTOOL | 0.83 | OA综合利用工具,集合将近20款OA漏洞批量扫描 |
项目名称 | 版本 | 项目描述 |
---|---|---|
CNVD-2021-49104 | CNVD-2021-49104——泛微E-Office文件上传漏洞 | |
DBconfigReader | 泛微ecology OA系统接口存在数据库配置信息泄露漏洞 | |
Weaver-OA-E-colog y-Database-Leak |
泛微OA数据库配置泄漏检测脚本 | |
e-cology-OA-SQL | 泛微 e-cology OA 前台SQL注入 | |
e-cology | e-cology OA_Beanshell_RCE |
项目名称 | 版本 | 项目描述 |
---|---|---|
TongdaOATools | ||
TDOA_RCE | v1.0 | 通达OA综合利用工具 |
TongDaOA-Fake-Use r |
通达OA 任意用户登录漏洞 | |
TongDa-OA | 通达OA一些漏洞点 |
项目名称 | 版本 | 项目描述 |
---|---|---|
yonyou_exp_plus | 用友系列全漏洞检测工具 | |
fupo_for_yonyou | 2.0RC1 | 用友漏洞检测,持续更新漏洞检测模块 |
yonyou-nc-decrypt er |
0.1.0 | 用友 nc 系列密码解密 |
NCTOOls | 一款针对用友NC综合漏洞利用工具 | |
YongYouNcTool | 1.0 | 用友NC系列漏洞检测利用工具,支持一键检测、命令执行回显、文件落 地、一键打入内存马、文件读取等 |
项目名称 | 版本 | 项目描述 |
---|---|---|
SeeyonExploit-GUI | 致远OA综合利用工具V1.0 | |
PassDecode-jar | v0.1 | 帆软/致远密码解密工具 |
seeyon_exp | 致远OA综合利用工具 | |
A8-OA-seeyon-RCE | A Zhiyuan OA Collaborative Office Remote Code Execution Vulner ability on Windows |
项目名称 | 版本 | 项目描述 |
---|---|---|
Landray-OA-Treexm l-Rce |
蓝凌OA远程代码执行漏洞批量检查 | |
LandrayDES | V1 | 蓝凌OA的前后台密码的加解密工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Goby | Beta2.2 .0 |
Attack surface mapping |
railgun | v1.5.5 | |
zpscan | v1.8.39 | 一个有点好用的信息收集工具。A somewhat useful information gath ering tool. |
项目名称 | 版本 | 项目描述 |
---|---|---|
UEditorGetShell | UEditor编辑器批量GetShell / Code By:Tas9er |
####### 框架漏洞 ######## Apache Airflow
项目名称 | 版本 | 项目描述 |
---|---|---|
CVE-2022-40127 | Apache Airflow < 2.4.0 DAG example_bash_operator RCE POC | |
######## Apache Dubbo | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
dubbo-exp | dubbo学习demo,之前删了,重新上传。 | |
######## Apache Log4j | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
log4jscanner | v0.5.0 | A log4j vulnerability filesystem scanner and Go package for an alyzing JAR files. |
logging-log4j2 | rel/2.2 2.0 |
Apache Log4j 2 is a versatile, feature-rich, efficient logging API and backend for Java. |
Log4j2-CVE-2021-4 4228 |
Remote Code Injection In Log4j | |
CVE-2021-44228-Po C-log4j-bypass-wor ds |
🐱💻 ✂️ 🤬 CVE-2021-44228 - LOG4J Java exploit - WAF bypas s tricks |
|
######## Apache Shiro | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
ShiroExploit-Depr ecated |
v2.51 | Shiro550/Shiro721 一键化利用工具,支持多种回显方式 |
shiro_attack | 2.2 | shiro反序列化漏洞综合利用,包含(回显执行命令/注入内存马) |
ShiroAttack2 | 4.7.0 | shiro反序列化漏洞综合利用,包含(回显执行命令/注入内存马)修复 原版中NoCC的问题 https://github.com/j1anFen/shiro_attack |
shiro_rce_tool | shiro 反序列 命令执行辅助检测工具 | |
SHIRO-550 | Shiro RememberMe 1.2.4 反序列化 漏洞 | |
ShiroScan | Shiro<=1.2.4反序列化,一键检测工具 | |
shiro-550-with-No CC |
V1.1 | Shiro-550 不依赖CC链利用工具 |
shiro-cve-2020-17 523 |
shiro-cve-2020-17523 漏洞的两种绕过姿势分析 以及配套的漏洞环境 | |
shiro-exploit | Shiro反序列化利用工具,支持新版本(AES-GCM)Shiro的key爆破,配合 ysoserial,生成回显Payload |
|
######## Apache Solr | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
solr_exploit | Apache Solr远程代码执行漏洞(CVE-2019-0193) Exploit | |
CVE-2019-0193 | Apache Solr DataImport Handler RCE | |
Apache-Solr-RCE | Apache Solr Exploits 🌟 | |
solr-injection | Apache Solr Injection Research | |
CVE-2019-12409 | Apache Solr RCE (ENABLE_REMOTE_JMX_OPTS="true") | |
solr_rce | Apache Solr RCE via Velocity template | |
Solr-SSRF | Apache Solr SSRF(CVE-2021-27905) | |
CVE-2019-17558_So lr_Vul_Tool |
1.0 | CVE-2019-17558 Solr模板注入漏洞图形化一键检测工具。CVE-2019-17 558 Solr Velocity Template Vul POC Tool. |
CVE-2019-0192 | RCE on Apache Solr using deserialization of untrusted data via jmx.serviceUrl |
|
######## Apache Struts2 | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
Struts2-Scan | Struts2全漏洞扫描利用工具 | |
STS2G | 1.0 | Struts2漏洞扫描利用工具 - Golang版. Struts2 Scanner Written in Golang |
struts-pwn_CVE-20 18-11776 |
An exploit for Apache Struts CVE-2018-11776 | |
S2-053-CVE-2017-1 2611 |
A simple script for exploit RCE for Struts 2 S2-053(CVE-2017-1 2611) |
|
struts-pwn | An exploit for Apache Struts CVE-2017-5638 | |
struts-pwn_CVE-20 17-9805 |
An exploit for Apache Struts CVE-2017-9805 | |
CVE-2019-0230 | CVE-2019-0230 & s2-059 poc. | |
struts-scan | Python2编写的struts2漏洞全版本检测和利用工具 | |
S2-061 | some struts tag , attributes which out of the range will call SetDynamicAttribute() function, it will cause ONGL expression e xecute |
|
Struts2Environmen t |
Struts2 历史版本的漏洞环境 | |
Struts2VulsTools | 2.3.201 90927 |
Struts2系列漏洞检查工具 |
Struts-S2-xxx | 整理收集Struts2漏洞环境 | |
s2-016-exp | S2-016 Exploit && Scanner | |
######## Apache Tomcat | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
AttackTomcat | V1 | Tomcat常见漏洞GUI利用工具。CVE-2017-12615 PUT文件上传漏洞、tom cat-pass-getshell 弱认证部署war包、弱口令爆破、CVE-2020-1938 To mcat AJP文件读取/包含 |
Tomcat_PUT_GUI_EX P |
1.4 | Tomcat PUT方法任意文件写入(CVE-2017-12615)exp |
CVE-2017-12617 | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution |
|
CVE-2019-0232 | Apache Tomcat Remote Code Execution on Windows | |
CVE-2019-0232 | Apache Tomcat Remote Code Execution on Windows - CGI-BIN | |
CVE-2017-12615 | POC Exploit for Apache Tomcat 7.0.x CVE-2017-12615 PUT JSP vul nerability. |
|
CVE-2020-9484 | 用Kali 2.0复现Apache Tomcat Session反序列化代码执行漏洞 | |
######## Fastjson | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
FastjsonScan | v1.1 | Fastjson扫描器,可识别版本、依赖库、autoType状态等。A tool to distinguish fastjson ,version and dependency |
FastjsonExploit | Fastjson vulnerability quickly exploits the framework(fastjso n漏洞快速利用框架) |
|
FastjsonVulns | [fastjson 1.2.80] CVE-2022-25845 aspectj fileread & groovy rem ote classload |
|
fastjson-autotype -bypass-dem |
||
fastjson_rec_expl oit |
fastjson一键命令执行 | |
Fastjson | Fastjson姿势技巧集合 | |
fastjson | 1.2.83 | FASTJSON 2.0.x has been released, faster and more secure, reco mmend you upgrade. |
fastjsonVul | fastjson 80 远程代码执行漏洞复现 | |
fastjson-check | beta | fastjson 被动扫描、不出网payload生成 |
######## Hikvision | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
HikvisionDecode | ||
######## IIS | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
IIS_shortname_Sca nner |
an IIS shortname Scanner | |
######## JBoss | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
jexboss | JexBoss: Jboss (and Java Deserialization Vulnerabilities) veri fy and EXploitation Tool |
|
jboss-_CVE-2017-1 2149 |
CVE-2017-12149 jboss反序列化 可回显 | |
######## log4j | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
log4j-shell-poc | A Proof-Of-Concept for the CVE-2021-44228 vulnerability. | |
######## SmartBI | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
SmartBIAttackTool | v1.0 | SmartBI 登录代码逻辑漏洞导致的远程代码执行利用工具 |
######## Spring Boot | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
SpringBootExploit | 1.3 | 项目是根据LandGrey/SpringBootVulExploit清单编写,目的hvv期间快 速利用漏洞、降低漏洞利用门槛。 |
SpringBoot-Scan-G UI |
v1.2.2 | |
SpringExploit | 0.1.9 | 🚀 一款为了学习go而诞生的漏洞利用工具 |
Spring_All_Reacha ble |
v2.1 | Spring漏洞综合利用工具 |
######## ThinkCMF | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
ThinkCMF_getshell | ThinkCMF 框架上的任意内容包含漏洞 | |
######## Thinkphp | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
thinkphp_gui_tool s |
v2.4.2 | ThinkPHP漏洞综合利用工具, 图形化界面, 命令执行, 一键getshell, 批量检测, 日志遍历, session包含,宝塔绕过 |
VulnerabilityTool s |
[CVE_2023_28432漏洞 、CVE_2023_32315漏洞、 ThinkPHP 2.x 任意代 码执行漏洞 、ThinkPHP5 5.0.22/5.1.29 远程代码执行漏洞、 ThinkPHP 5 5.0.23 远程代码执行漏洞 ThinkPHP 多语言本地文件包含漏洞] |
|
ThinkphpGUI | 1.3 | Thinkphp(GUI)漏洞利用工具,支持各版本TP漏洞检测,命令执行,get shell。 |
Aazhen-RexHa | 自研JavaFX图形化漏洞扫描工具,支持扫描的漏洞分别是: ThinkPHP- 2.x-RCE, ThinkPHP-5.0.23-RCE, ThinkPHP5.0.x-5.0.23通杀RCE, T hinkPHP5-SQL注入&敏感信息泄露, ThinkPHP 3.x 日志泄露NO.1, Thi nkPHP 3.x 日志泄露NO.2, ThinkPHP 5.x 数 |
|
ThinkphpRCE | Thinkphp rce扫描脚本,附带日志扫描 | |
thinkphp-RCE-POC- Collection |
thinkphp v5.x 远程代码执行漏洞-POC集合 | |
tphack | Thinkphp3/5 Log文件泄漏利用工具 | |
tp5-getshell | thinkphp5 rce getshell | |
ThinkPHP-Vuln | 关于ThinkPHP框架的历史漏洞分析集合 | |
fastadmin | 基于 ThinkPHP5 和 Bootstrap 的极速后台开发框架,一键生成 CRUD ,自动生成控制器、模型、视图、JS、语言包、菜单、回收站。 |
|
ThinkAdmin | 基于 ThinkPHP6 的极简后台管理系统,内置注解权限、异步多任务、 应用插件生态等,支持类 PaaS 更新公共模块和应用插件,插件可本地化 定制开发。 |
|
TPscan | 一键ThinkPHP漏洞检测 | |
######## vmware | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
Vm4J | A tool for detect&exploit vmware product log4j(cve-2021-44228) vulnerability.Support VMware HCX/vCenter/NSX/Horizon/vRealize Operations Manager |
|
VcenterKiller | v1.3.6 | 一款针对Vcenter的综合利用工具,包含目前最主流的CVE-2021-21972 、CVE-2021-21985以及CVE-2021-22005、One Access的CVE-2022-22954、 CVE-2022-22972/31656以及log4j,提供一键上传webshell,命令执行或 者上传公钥使用SSH免密连接 |
######## Weblogic | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
CVE-2023-21839 | ||
weblogic-framewor k |
v0.2.3 | weblogic-framework is the best tool for detecting weblogic vul nerabilities. |
WeblogicTool | v1.3 | WeblogicTool,GUI漏洞利用工具,支持漏洞检测、命令执行、内存马 注入、密码解密等(深信服深蓝实验室天威战队强力驱动) |
Decrypt_Weblogic_ Password |
搜集了市面上绝大部分weblogic解密方式,整理了7种解密weblogic的 方法及响应工具。 |
|
weblogicScanner | weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力:CVE-2014- 4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-350 6、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894 、CVE-2018-3191、CVE-2018 |
|
CVE-2017-10271 | CVE-2017-10271 WEBLOGIC RCE (TESTED) | |
Weblogic | Weblogic CVE-2019-2725 CVE-2019-2729 Getshell 命令执行 | |
WebLogicPasswordD ecryptorUi |
v2.0 | 解密weblogic AES或DES加密方法 |
WeblogicScan | 增强版WeblogicScan、检测结果更精确、插件化、添加CVE-2019-2618 ,CVE-2019-2729检测,Python3支持 |
|
CVE-2020-2551 | how detect CVE-2020-2551 poc exploit python Weblogic RCE with IIOP |
|
CNVD-C-2019-48814 | WebLogic wls9-async反序列化远程命令执行漏洞 | |
cve-2019-2618 | Weblogic Upload Vuln(Need username password)-CVE-2019-2618 | |
CVE-2019-2890 | CVE-2019-2890 WebLogic 反序列化RCE漏洞 | |
CVE-2020-2551 | Weblogic RCE with IIOP | |
CVE-2018-2894 | CVE-2018-2894 WebLogic Unrestricted File Upload Lead To RCE Ch eck Script |
|
WeblogicEnvironme nt |
Weblogic环境搭建工具 | |
WeblogicScanLot | WeblogicScanLot系列,Weblogic漏洞批量检测工具,V2.2 | |
CVE-2020-14645 | Weblogic CVE-2020-14645 UniversalExtractor JNDI injection getD atabaseMetaData() |
|
CVE-2020-14756 | WebLogic T3/IIOP RCE ExternalizableHelper.class of coherence.j ar |
|
CVE-2020-2551 | Weblogic IIOP CVE-2020-2551 | |
CVE-2020-2555 | Weblogic com.tangosol.util.extractor.ReflectionExtractor RCE | |
CVE-2020-2883 | Weblogic coherence.jar RCE | |
######## Nacos | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
HKEcho_Nacos |
项目名称 | 版本 | 项目描述 |
---|---|---|
CRLFsuite |
项目名称 | 版本 | 项目描述 |
---|---|---|
CORScanner | 1.0.1 | 🎯 Fast CORS misconfiguration vulnerabilities scanner |
项目名称 | 版本 | 项目描述 |
---|---|---|
slowhttptest | v1.9.0 | Application Layer DoS attack simulator |
项目名称 | 版本 | 项目描述 |
---|---|---|
JWT_GUI | replace _brute_e rror |
基于pyqt5和pyjwt实现的jwt加解密爆破一体化工具(ps:其实是水的pyt hon课设) |
JWTPyCrack | JWT 弱口令 Key 爆破以及生成 NONE 加密的无 Key 的 JWTString | |
jwt-hack | v1.1.2 | 🔩 jwt-hack is tool for hacking / security testing to JWT. Sup ported for En/decoding JWT, Generate payload for JWT attack and very fast cracking(dict/brutefoce) |
jwt_tool | v2.2.6 | 🐍 A toolkit for testing, tweaking and cracking JSON Web Tokens |
RS256-2-HS256 | JWT Attack to change the algorithm RS256 to HS256 | |
c-jwt-cracker | JWT brute force cracker written in C | |
jwt-fuzzer | JWT fuzzer | |
JWT4B | 2.3 | JWT Support for Burp |
项目名称 | 版本 | 项目描述 |
---|---|---|
ghauri | 1.2.9 | An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws |
sqlmap | 1.7 | Automatic SQL injection and database takeover tool |
MSSQL_SQL_BYPASS_ WIKI |
MSSQL注入提权,bypass的一些总结 | |
MYSQL_SQL_BYPASS_ WIKI |
mysql注入,bypass的一些心得 | |
sql-injection-pay load-list |
🎯 SQL Injection Payload List |
项目名称 | 版本 | 项目描述 |
---|---|---|
SSRFmap | Automatic SSRF fuzzer and exploitation tool | |
ssrf-sheriff | A simple SSRF-testing sheriff written in Go |
项目名称 | 版本 | 项目描述 |
---|---|---|
tplmap | v0.5 | Server-Side Template Injection and Code Injection Detection an d Exploitation Tool |
SSTImap | v1.1 | Automatic SSTI detection tool with interactive interface |
ssti-payload | SSTI Payload Generator |
项目名称 | 版本 | 项目描述 |
---|---|---|
beef | v0.5.4. 0 |
The Browser Exploitation Framework Project |
xsscrapy | XSS spider - 66/66 wavsep XSS detected | |
findom-xss | A fast DOM based XSS vulnerability scanner with simplicity. | |
dalfox | v2.9.1 | 🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation. |
Chromium-based-XS S-Taint-Tracking |
v0.3 | Cyclops 是一款具有 XSS 检测功能的浏览器 |
项目名称 | 版本 | 项目描述 |
---|---|---|
oxml_xxe | A tool for embedding XXE/XML exploits into different filetypes | |
docem | 1.3 | Uility to embed XXE and XSS payloads in docx,odt,pptx,etc (OX ML_XEE on steroids) |
####### Nginx
项目名称 | 版本 | 项目描述 |
---|---|---|
nginxpwner | Nginxpwner is a simple tool to look for common Nginx misconfig urations and vulnerabilities. |
项目名称 | 版本 | 项目描述 |
---|---|---|
liffy | Local file inclusion exploitation tool |
项目名称 | 版本 | 项目描述 |
---|---|---|
PocList | Alibaba-Nacos-Unauthorized/ApacheDruid-RCE_CVE-2021-25646/MS-E xchange-SSRF-CVE-2021-26885/Oracle-WebLogic-CVE-2021-2109_RCE/R G-CNVD-2021-14536/RJ-SSL-VPN-UltraVires/Redis-Unauthori |
|
Some-PoC-oR-ExP | 各种漏洞poc、Exp的收集或编写 | |
POChouse | POC&EXP仓库、hvv弹药库、Nday、1day | |
0day | 各种CMS、各种平台、各种系统、各种软件漏洞的EXP、POC ,该项目将 持续更新 |
|
vulnerability | 收集、整理、修改互联网上公开的漏洞POC | |
Awesome-Exploit | 一个漏洞利用工具仓库 | |
CVE-Master | v1.0.1 | 收集本人自接触渗透测试用于漏洞验证的所有热门CVE、POC、CNVD攻击 有效载荷+测试工具+FUZZ,一个仓库满足许多攻击测试场景,开箱即用. |
poc-hub | ||
PocOrExp_in_Githu b |
聚合Github上已有的Poc或者Exp,CVE信息来自CVE官网。Auto Collect Poc Or Exp from Github by CVE ID. |
|
exphub | Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、S olr、Jboss、Drupal的漏洞利用脚本,最新添加CVE-2020-14882、CVE-2 020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2 020-2551、CVE-2020-2555、C |
项目名称 | 版本 | 项目描述 |
---|---|---|
JNDIExploit | 1.1 | 一款用于JNDI注入利用的工具,大量参考/引用了Rogue JNDI项目的代 码,支持直接植入内存shell,并集成了常见的bypass 高版本JDK的方式 ,适用于与自动化工具配合使用。 |
cola_dnslog | v1.3.2 | Cola Dnslog v1.3.2 更加强大的dnslog平台/无回显漏洞探测辅助平台 完全开源 dnslog httplog ldaplog rmilog 支持dns http ldap rmi等 协议 提供API调用方式便于与其他工具结合 支持钉钉机器人、Bark等提 醒 支持docker一键部署 后端完全使用python实现 前端基于vue-elemen |
godnslog | v0.7.0 | An exquisite dns&http log server for verify SSRF/XXE/RFI/RCE v ulnerability |
Exp-Tools | v1.2.3 | 一款集成高危漏洞exp的实用性工具 |
ysoserial | v0.0.6 | A proof-of-concept tool for generating payloads that exploit u nsafe Java object deserialization. |
DNSlog-GO | master | DNSLog-GO 是一款golang编写的监控 DNS 解析记录的工具,自带WEB界 面 / DNSLog-GO is a monitoring tool written in Golang that monit ors DNS resolution records. It comes with a web interface. |
revsuit | v0.7.1 | RevSuit is a flexible and powerful reverse connection platform designed for receiving connection from target host in penetrat ion. |
JNDIExploit-1 | v1.2 | 一款用于 JNDI注入 利用的工具,大量参考/引用了 Rogue JNDI 项目 的代码,支持直接植入内存shell,并集成了常见的bypass 高版本JDK的 方式,适用于与自动化工具配合使用。(from https://github.com/feih ong-cs/JNDIExploit) |
JNDIExploit | ||
ddddocr | 带带弟弟 通用验证码识别OCR pypi版 | |
ysoserial | ||
Gopherus | This tool generates gopher link for exploiting SSRF and gainin g RCE in various servers |
|
ysomap | v0.1.5 | A helpful Java Deserialization exploit framework. |
JNDIExploit | v1.4 | 对原版https://github.com/feihong-cs/JNDIExploit 进行了实用化修 改 |
Antenna | v1.3.5 | Antenna是58同城安全团队打造的一款辅助安全从业人员验证网络中多 种漏洞是否存在以及可利用性的工具。其基于带外应用安全测试(OAST)通 过任务的形式,将不同漏洞场景检测能力通过插件的形式进行集合,通过 与目标进行out-bind的数据通信方式进行辅助检测。 |
jndi_tool | JNDI服务利用工具 RMI/LDAP,支持部分场景回显、内存shell,高版本 JDK场景下利用等,fastjson rce命令执行,log4j rce命令执行 漏洞检 测辅助工具 |
|
DNSLog | DNSLog 是一款监控 DNS 解析记录和 HTTP 访问记录的工具。 | |
Alphalog | 1.0.0.R elease |
DNSLOG、httplog、rmilog、ldaplog、jndi 等都支持,完全匿名 产品( fuzz.red),Alphalog与传统DNSLog不同,更快、更安全。 |
DNSLog-Platform-G olang |
v0.3 | DNSLOG平台 golang |
JNDI-Exploit-Kit | JNDI-Exploitation-Kit(A modified version of the great JNDI-In jection-Exploit created by @welk1n. This tool can be used to st art an HTTP Server, RMI Server and LDAP Server to exploi |
|
JNDI-Injection-Ex ploit |
v1.0 | JNDI注入测试工具(A tool which generates JNDI links can start several servers to exploit JNDI Injection vulnerability,like Ja ckson,Fastjson,etc) |
JNDIMonitor | 一个LDAP请求监听器,摆脱dnslog平台 |
项目名称 | 版本 | 项目描述 |
---|---|---|
woodpecker-framew ork-release |
1.3.5 | 高危漏洞精准检测与深度利用框架 |
项目名称 | 版本 | 项目描述 |
---|---|---|
VulWiki | VulWiki | |
FrameVul | POC集合,框架nday漏洞利用 | |
bylibrary | 白阁文库是白泽Sec安全团队维护的一个漏洞POC和EXP公开项目 | |
vulbase | 各大漏洞文库合集 | |
PoC-ExP | 【漏洞Poc知识库】一个网络安全爱好者对网络上一些已知漏洞payload 的收录,持续更新。并编写了利用脚本,可用于日常学习或批量的src漏 洞挖掘 |
|
Report_Public | DVPNET 公开漏洞知识库 | |
yougar0.github.io | 漏洞知识库 | |
BUG-Pocket | 小型漏洞库,提供FOFA语法及批量脚本,具体利用法请参考别的漏洞库 ,共4种类型47项 |
|
PeiQi-WIKI-Book | 面向网络安全从业者的知识文库🍃 | |
WiKi | 稻草人安全团队漏洞库 | |
Awesome-POC | 一个漏洞POC知识库 | |
Vulhub-Reproduce | 一个Vulhub漏洞复现知识库 | |
Vulnerability-Wik i |
v1.0 | 基于 docsify 部署,目前漏洞数量 1000+ |
PoC-in-GitHub | 📡 PoC auto collect from GitHub. |
项目名称 | 版本 | 项目描述 |
---|---|---|
ds_store_exp | A .DS_Store file disclosure exploit. It parses .DS_Store file and downloads files recursively. |
项目名称 | 版本 | 项目描述 |
---|---|---|
git-dumper | A tool to dump a git repository from a website | |
GitHack | .git 泄漏利用工具,可还原历史版本 | |
scrabble | Simple tool to recover .git folder from remote server | |
GitHack | A .git folder disclosure exploit | |
GitDorker | A Python program to scrape secrets from GitHub through usage o f a large repository of dorks. |
|
Git_Extract | 提取远程 git 泄露或本地 git 的工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
svnExploit | SvnExploit支持SVN源代码泄露全版本Dump源码 |
项目名称 | 版本 | 项目描述 |
---|---|---|
JDumpSpider | dev-202 30406T03 1230 |
HeapDump敏感信息提取工具 |
heapdump_tool | heapdump敏感信息查询工具,例如查找 spring heapdump中的密码明文 ,AK,SK等 |
项目名称 | 版本 | 项目描述 |
---|---|---|
idea_exploit | Gather sensitive information from (.idea) folder for pentester s |
项目名称 | 版本 | 项目描述 |
---|---|---|
cloudTools | main | 云资产管理工具 目前工具定位是云安全相关工具,目前是两个模块 云 存储工具、云服务工具, 云存储工具主要是针对oss存储、查看、删除、 上传、下载、预览等等 云服务工具主要是针对rds、服务器的管理,查看 、执行命令、接管等等 |
AliyunAccessKeyTo ols |
1.0 | 阿里云AccessKey泄漏利用工具 |
API-T00L | v1.2 | 互联网厂商API利用工具。 |
cf | ||
Cloud-Bucket-Leak -Detection-Tools |
v0.4.0 | 六大云存储,泄露利用检测工具 |
aksk_tool | AK资源管理工具,阿里云/腾讯云/华为云/AWS/UCLOUD/京东云/百度云/ 七牛云存储 AccessKey AccessKeySecret,利用AK获取资源信息和操作资 源,ECS/CVM/E2/UHOST/ECI/BCC执行命令,OSS/COS/S3/BOS管理,RDS/DB 管理,域名管理,添加RAM/CAM/IAM账号等 |
项目名称 | 版本 | 项目描述 |
---|---|---|
swagger-hack | 自动化爬取并自动测试所有swagger接口 | |
swagger-exp | A Swagger API Exploit |
项目名称 | 版本 | 项目描述 |
---|---|---|
Packer-Fuzzer | v1.4 | Packer Fuzzer is a fast and efficient scanner for security det ection of websites constructed by javascript module bundler suc h as Webpack. |
项目名称 | 版本 | 项目描述 |
---|---|---|
dvcs-ripper | Rip web accessible (distributed) version control systems: SVN/ GIT/HG... |
|
dumpall | v0.4.0 | 一款信息泄漏利用工具,适用于.git/.svn/.DS_Store泄漏和目录列出 |
项目名称 | 版本 | 项目描述 |
---|---|---|
JSFScan.sh | Automation for javascript recon in bug bounty. | |
SecretFinder | SecretFinder - A python script for find sensitive data (apikey s, accesstoken,jwt,..) and search anything on javascript files |
|
Mantra | v.1.1 | 「🔑」A tool used to hunt down API key leaks in JS files and p ages |
项目名称 | 版本 | 项目描述 |
---|---|---|
wprecon | ||
wpreconx | 2.4.5 | WPRecon, is a tool for the recognition of vulnerabilities and blackbox information for wordpress. |
CMSmap | CMSmap is a python open source CMS scanner that automates the process of detecting security flaws of the most popular CMSs. |
|
QVD-2023-13065 | Nacos JRaft Hessian 反序列化 RCE EXP | |
wordpress-exploit -framework |
v2.0.1 | A Ruby framework designed to aid in the penetration testing of WordPress systems. |
CVE-2023-33246 | Apache RocketMQ 远程代码执行漏洞(CVE-2023-33246) Exploit | |
EgGateWayGetShell | Code By:Tas9er | |
Apt_t00ls | v0.7 | 高危漏洞利用工具 |
wpscan | v3.8.25 | WPScan WordPress security scanner. Written for security profes sionals and blog maintainers to test the security of their Word Press websites. Contact us via [email protected] |
LandrayExploit | ||
weaver_exp | 泛微OA漏洞综合利用脚本 | |
2021hvv_vul | 2021hvv漏洞汇总 | |
CMS-Exploit-Frame work |
CMS Exploit Framework | |
CMS-Hunter | CMS漏洞测试用例集合 |
项目名称 | 版本 | 项目描述 |
---|---|---|
SubOver | v1.2 | A Powerful Subdomain Takeover Tool |
项目名称 | 版本 | 项目描述 |
---|---|---|
jdwp-shellifier | ||
jdwp-shellifier | 修改利用方式为通过对Sleeping的线程发送单步执行事件,达成断点, 从而可以直接获取上下文、执行命令,而不用等待断点被击中。 |
|
jdwp-codeifier | 基于 jdwp-shellifier 的进阶JDWP漏洞利用脚本(动态执行Java/Js代 码并获得回显) |
项目名称 | 版本 | 项目描述 |
---|---|---|
CVE-2019-0708 | 3389远程桌面代码执行漏洞CVE-2019-0708批量检测工具(Rdpscan Blue keep Check) |
|
CVE-2019-0708 | CVE-2019-0708 (BlueKeep) |
项目名称 | 版本 | 项目描述 |
---|---|---|
attackRmi | v2.0 | |
rmiscout | v1.4 | RMIScout uses wordlist and bruteforce strategies to enumerate Java RMI functions and exploit RMI parameter unmarshalling vuln erabilities |
BaRMIe | v1.01 | Java RMI enumeration and attack tool. |
attackRmi | v0.1 | attackRmi |
项目名称 | 版本 | 项目描述 |
---|---|---|
mssqlproxy | 0.1 | mssqlproxy is a toolkit aimed to perform lateral movement in r estricted environments through a compromised Microsoft SQL Serv er via socket reuse |
SharpSQLTools | 41 | SharpSQLTools 和@Rcoil一起写的小工具,可上传下载文件,xp_cmdsh ell与sp_oacreate执行命令回显和clr加载程序集执行相应操作。 |
SqlKnife_0x727 | 1.2 | 适合在命令行中使用的轻巧的SQL Server数据库安全检测工具 |
PySQLTools | Mssql利用工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
odat | 5.1.1 | ODAT: Oracle Database Attacking Tool |
oracleShell | oracle 数据库命令执行 |
项目名称 | 版本 | 项目描述 |
---|---|---|
postgresql_udf_he lp |
PostgreSQL 提权辅助脚本 |
项目名称 | 版本 | 项目描述 |
---|---|---|
RabR | 0.6.2 | Redis-Attack By Replication (通过主从复制攻击Redis) |
redis-rogue-serve r |
Redis 4.x/5.x RCE | |
redis-rogue-serve r |
Redis(<=5.0.5) RCE | |
redis-rce | Redis 4.x/5.x RCE | |
RedisEXP | 0.0.3 | Redis 漏洞利用工具 |
redis_rce | v0.1.0 | Redis primary/secondary replication RCE |
RedisModules-Exec uteCommand-for-Win dows |
可在Windows下执行系统命令的Redis模块,可用于Redis主从复制攻击 。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
RequestTemplate | ||
Databasetools | 1.2 | 一款用Go语言编写的数据库自动化提权工具,支持Mysql、MSSQL、Post gresql、Oracle、Redis数据库提权、命令执行、爆破以及ssh连接 |
MDUT | v2.1.1 | MDUT - Multiple Database Utilization Tools |
PentestDB | 各种数据库的利用姿势 |
项目名称 | 版本 | 项目描述 |
---|---|---|
http://rootkiter.com/Termite/ | ||
dns2tcp | v0.5.2 | |
nps | v0.26.1 0 |
一款轻量级、高性能、功能强大的内网穿透代理服务器。支持tcp、udp 、socks5、http等几乎所有流量转发,可用来访问内网网站、本地支付接 口调试、ssh访问、远程桌面,内网dns解析、内网socks5代理等等……, 并带有功能强大的web管理端。a lightweight, high-performance, powe rful intranet penet |
pingtunnel | 2.8 | Pingtunnel is a tool that send TCP/UDP traffic over ICMP |
frp | v0.53.0 | A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet. |
pystinger | v1.6 | Bypass firewall for traffic forwarding using webshell 一款使用 webshell进行流量转发的出网工具 |
Erfrp | v0.1 | Erfrp-frp二开-免杀与隐藏 |
dnscat2 | ||
ngrok | Introspected tunnels to localhost | |
icmpsh | ||
PortForward | 0.5.0 | The port forwarding tool developed by Golang solves the proble m that the internal and external networks cannot communicate in certain scenarios |
Neo-reGeorg | v5.1.0 | Neo-reGeorg is a project that seeks to aggressively refactor r eGeorg |
rakshasa | v0.2.3 | 基于go编写的跨平台、稳定、隐秘的多级代理内网穿透工具 |
frp_cmd | v0.38.0 _modify |
frp修改版,增加socks、pf命令,便捷启用socks5代理、端口转发,且 去除流量特征,增加loadini命令,支持命令行参数导入base64编码的配 置文件 |
Stowaway | v2.1 | 👻Stowaway -- Multi-hop Proxy Tool for pentesters |
slcx | v1.0.2 | 端口转发工具,绕过流量安全检测。 |
reGeorg | The successor to reDuh, pwn a bastion webserver and create SOC KS proxies through the DMZ. Pivot and pwn. |
|
goproxy | v14.1 | 🔥 Proxy is a high performance HTTP(S) proxies, SOCKS5 proxies ,WEBSOCKET, TCP, UDP proxy server implemented by golang. Now, i t supports chain-style proxies,nat forwarding in differe |
suo5 | v0.9.0 | 一款高性能 HTTP 代理隧道工具 |
https://www.proxifier.com/ |
项目名称 | 版本 | 项目描述 |
---|---|---|
Intranet-Movement -Kit |
V1.0 | 内网横向移动工具箱 |
OLa | OLa__20 220724 |
|
impacket | impacke t_0_11_0 |
Impacket is a collection of Python classes for working with ne twork protocols. |
VMInjector | DLL Injection tool to unlock guest VMs | |
Intranet-tools | ||
sharpwmi | v2 | sharpwmi是一个基于rpc的横向移动工具,具有上传文件和执行命令功 能。 |
WMIHACKER | A Bypass Anti-virus Software Lateral Movement Command Executio n Tool |
|
java-impacket-gui | java-impacket-gui | |
Impacket_For_Web | ||
wmiexec-Pro | v0.2.6 | New generation of wmiexec.py |
impacket-gui | impacket-gui | |
https://xz.aliyun.com/t/9382 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Template | v1.2.5 | Next generation RedTeam heuristic intranet scanning |
ServerScan | v1.0.2 | ServerScan一款使用Golang开发的高并发网络扫描、服务探测工具。 |
ADCSKiller | An ADCS Exploitation Automation Tool Weaponizing Certipy and C oercer |
|
Gscan | v1.0 | Gscan is a high concurrency scanner based on golang |
goon | v3.5 | goon,集合了fscan和kscan等优秀工具功能的扫描爆破工具。功能包含 :ip探活、port扫描、web指纹扫描、title扫描、压缩文件扫描、fofa获 取、ms17010、mssql、mysql、postgres、redis、ssh、smb、rdp、telne t、tomcat等爆破以及如netbios探测等功能。 |
InScan | 边界打点后的自动化渗透工具 | |
kscan | v1.85 | Kscan是一款纯go开发的全方位扫描器,具备端口扫描、协议检测、指 纹识别,暴力破解等功能。支持协议1200+,协议指纹10000+,应用指纹2 0000+,暴力破解协议10余种。 |
fscan | 1.8.3 | 一款内网综合扫描工具,方便一键自动化、全方位漏扫扫描。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
ATAttack | 敌后侦察 | |
netspy | v0.0.5 | netspy是一款快速探测内网可达网段工具(深信服深蓝实验室天威战队 强力驱动) |
SharpHostInfo | v0.0.1 | SharpHostInfo是一款快速探测内网主机信息工具(深信服深蓝实验室 天威战队强力驱动) |
HostInfoScan | 红队小工具 | |
netdiscover | netdiscover | |
Adinfo | v0.3 | 域信息收集工具 |
ClipboardHistoryT hief |
POC tool to extract all persistent clipboard history data from clipboard service process memory |
|
TakeMyRDP | A keystroke logger targeting the Remote Desktop Protocol (RDP) related processes, It utilizes a low-level keyboard input hook , allowing it to record keystrokes in certain contexts |
项目名称 | 版本 | 项目描述 |
---|---|---|
PEASS-ng | 2023121 0-89d560 ba |
PEASS - Privilege Escalation Awesome Scripts SUITE (with color s) |
dirtycow | Dirty Cow exploit - CVE-2016-5195 | |
traitor | v0.0.14 | ⬆️ ☠️ 🔥 Automatic Linux prive sc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock |
LinEnum | Scripted Local Linux Enumeration & Privilege Escalation Checks | |
https://i.hacking8.com/tiquan/ |
项目名称 | 版本 | 项目描述 |
---|---|---|
BadPotato | Windows 权限提升 BadPotato | |
Windows-exploits | Windows Exploits Collecti ons |
Windows 平台提权漏洞大合集,长期收集各种提权漏洞利用工具。 A l arge collection of rights raising vulnerabilities on the window s platform, which collects various rights raising vulnerability utilization tool |
CoercedPotato |
项目名称 | 版本 | 项目描述 |
---|---|---|
Kernelhub | v1.1 | 🌴Linux、macOS、Windows Kernel privilege escalation v ulnerability collection, with compilation environment, demo GIF map, vulnerability details, executable file (提权漏洞合集) |
项目名称 | 版本 | 项目描述 |
---|---|---|
antSword | 2.1.15 | **蚁剑是一款跨平台的开源网站管理工具。AntSword is a cross-pl atform website management toolkit. |
Godzilla | v4.0.1- godzilla |
哥斯拉 |
WebshellManager | w8ay 一句话WEB端管理工具 | |
Cknife | Cknife | |
Webshell_Generate | v1.2.3 | 用于生成各类免杀webshell |
java-memshell-gen erator-release |
v1.0.7. beta3 |
一款支持高度自定义的 Java 内存马生成工具 |
Behinder | Behinde r_v4.0.6 |
“冰蝎”动态二进制加密网站管理客户端 |
Platypus | v1.5.0 | 🔨 A modern multiple reverse shell sessions manager writ ten in go |
As-Exploits | **蚁剑后渗透框架 |
项目名称 | 版本 | 项目描述 |
---|---|---|
webshell | 这是一些常用的webshell | |
AwesomeScript | AntSword Shell 脚本分享/示例 | |
AntSword-Loader | 4.0.3 | AntSword 加载器 |
AwesomeEncoder | AntSword 自定义编(解)码器分享 | |
vagent | v1.0.0 | 多功能 java agent 内存马 |
项目名称 | 版本 | 项目描述 |
---|---|---|
CloneX_0x727 | 1.0 | 进行克隆用户、添加用户等账户防护安全检测的轻巧工具 |
SchTask_0x727 | v1.0 | 创建隐藏计划任务,权限维持,Bypass AV |
HackerPermKeeper | 6.0 | |
CreateHiddenAccou nt |
0.2 | A tool for creating hidden accounts using the registry |
ShadowUser | 影子用户 克隆 |
项目名称 | 版本 | 项目描述 |
---|---|---|
AV_Evasion_Tool | 2023082 3 |
掩日 - 免杀执行器生成工具 |
killEscaper | Shellcode 免杀生成器 绕过火绒、360(Windows版本) | |
ShellCode_Loader | v0.0.1 | ShellCode_Loader - Msf&CobaltStrike免杀ShellCode加载器、Shellc ode_encryption - 免杀Shellcode加密生成工具,目前测试免杀360&火 绒&电脑管家&Windows Defender(其他杀软未测试)。 |
encdecshellcode | Shellcode Encrypter & Decrypter via XOR Cipher | |
SysWhispers2 | AV/EDR evasion via direct system calls. | |
shellcodeloader | v1.1 | shellcodeloader |
GobypassAV-shellc ode |
shellcode免杀加载器,使用go实现,免杀bypass火绒、360、核晶、de f等主流杀软 |
|
Qianji | Qianji_ BypassAV -sandbox -2023111 5 |
千机-红队免杀木马自动生成器 Bypass defender、火绒、360等国内主 流杀软 随机加密混淆shellcode快速生成免杀马 |
bypassAV | 免杀shellcode加载器 | |
BypassAntiVirus | 远控免杀系列文章及配套工具,汇总测试了互联网上的几十种免杀工具 、113种白名单免杀方式、8种代码编译免杀、若干免杀实战技术,并对免 杀效果进行了一一测试,为远控的免杀和杀软对抗免杀提供参考。 |
|
GoBypassAV | 整理了基于Go的16种API免杀测试、8种加密测试、反沙盒测试、编译混 淆、加壳、资源修改等免杀技术,并搜集汇总了一些资料和工具。 |
|
SharpShellcodeLoa der_Rc4Aes |
用于解密并加载shellcode,支持RC4和AES两种解密方法,并使用DInvo ke来动态调用WinAPI函数,从而尝试绕过某些安全解决方案 |
|
noterce | 1.3 | 一种另辟蹊径的免杀执行系统命令的木马 |
ZheTian | v3 | ::ZheTian / 强大的免杀生成工具,Bypass All. |
go-shellcode | Load shellcode into a new process | |
0xUBypass | 1.0.0 | AntiAV shellcode loader |
项目名称 | 版本 | 项目描述 |
---|---|---|
Sign-Sacker | Sign-Sacker(签名掠夺者):一款数字签名复制器,可将其他官方exe中 数字签名,图标,详细信息复制到没有签名的exe中,作为免杀,权限维 持,伪装的一种小手段。 |
|
SigThief | Stealing Signatures and Making One Invalid Signature at a Time |
项目名称 | 版本 | 项目描述 |
---|---|---|
BeCyIconGrabberPo rtable |
BeCyIconGrabber allows you to extract icons from almost any fi le! |
项目名称 | 版本 | 项目描述 |
---|---|---|
ChTimeStamp | Changing the Creation time and the Last Written time of a drop ped file by the timestamp of other one , like the "kernel32.dll " timestamp |
|
ChangeTimestamp | 一键修改exe、dll的编译时间、创建时间、修改时间和访问时间 |
项目名称 | 版本 | 项目描述 |
---|---|---|
go-strip | v3.0 | 清除Go编译时自带的信息 |
项目名称 | 版本 | 项目描述 |
---|---|---|
trojan_simple_dem o |
简单的用python写的远控demo 执行命令 只一个心跳完成所有操作 | |
Supershell | v2.0.0 | Supershell C2 远控平台,基于反向SSH隧道获取完全交互式Shell |
SimpleRemoter | v1.0.0. 5 |
基于gh0st的远程控制器:实现了终端管理、进程管理、窗口管理、远 程桌面、文件管理、语音管理、视频管理、服务管理、注册表管理等功能 ,优化全部代码及整理排版,修复内存泄漏缺陷,程序运行稳定。项目代 码仅限于学习和交流用途。 |
sliver | v1.5.41 | Adversary Emulation Framework |
项目名称 | 版本 | 项目描述 |
---|---|---|
ShuiYing_0x727 | V1.0 | 检测域环境内,域机器的本地管理组成员是否存在弱口令和通用口令, 对域用户的权限分配以及域内委派查询 |
BloodHound | v4.3.1 | Six Degrees of Domain Admin |
项目名称 | 版本 | 项目描述 |
---|---|---|
Viper | 2023-12 -03-13-4 4-27 |
Redteam operation platform with webui 图形化红队行动辅助平台 |
Ladon | v12.0 | Ladon大型内网渗透工具,可PowerShell模块化、可CS插件化、可内存 加载,无文件扫描。含端口扫描、服务识别、网络资产探测、密码审计、 高危漏洞检测、漏洞利用、密码读取以及一键GetShell,支持批量A段/B 段/C段以及跨网段扫描,支持URL、主机、域名列表扫描等。Ladon 12.0 内置256个功能,网络资产探测模块32个通过多种协议(ICMP\N |
项目名称 | 版本 | 项目描述 |
---|---|---|
metasploit-framew ork |
Metasploit Framework |
项目名称 | 版本 | 项目描述 |
---|---|---|
EmailSender | 钓鱼邮件便捷发送工具(GUI) | |
goblin | v0.4.6 | 一款适用于红蓝对抗中的仿真钓鱼系统 |
项目名称 | 版本 | 项目描述 |
---|---|---|
rotateproxy | v0.7.2 | 利用fofa搜索socks5开放代理进行代理池轮切的工具 |
ProxyPoolxSocks | v1.2 | ☁️Socks代理池服务端自动化搭建工具☁️ |
Gofreeproxy | v0.1 | 自用的动态代理小工具 |
proxy_pool | 2.4.1 | Python ProxyPool for web spider |
mubeng | v0.14.1 | An incredibly fast proxy checker & IP rotator with ease. |
go_proxy_pool | 2022.11 .22 |
无环境依赖开箱即用的代理IP池 |
proxyServer | v1.0 | 本项目其实就是个简单的代理服务器,把代理池集成进来来了。 |
Venom-Transponder | 毒液流量转发器:自动化捡洞/打点/跳板必备神器,支持联动URL爬虫 、各种被动扫描器。 |
|
Auto_proxy | 利用IP地址池进行自动切换Http代理,防止IP封禁。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
K8tools | K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破 解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/Bypass UAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zim bra/Weblogic/Tomcat/Apa |
项目名称 | 版本 | 项目描述 |
---|---|---|
ApoalypseSecTools | ApoalypseSecTool更新地址 | |
Pentest-Windows | v2.2 | Windows11 Penetration Suite Toolkit 一个开箱即用的windows渗透 测试环境 |
PST-Bucket | Scoop-Buket for Penetration Suite Toolkit | |
PenKitGui | 渗透测试武器库 | |
GUI_Tools | V1.1 | 一个由各种图形化渗透工具组成的工具集 |
commando-vm | Complete Mandiant Offensive VM (Commando VM), a fully customiz able Windows-based pentesting virtual machine distribution. com [email protected] |
|
okfafu-pentestVM- public |
okfafu渗透虚拟机公开版 | |
Taie-RedTeam-OS | 泰阿安全实验室-基于XUbuntu私人订制的红蓝对抗渗透操作系统 | |
FreeGui | v2.5 | freeGui:基于ttkbootstrap开发的一款用来管理自己的渗透测试工具 的一个小工具,并提供一些实用小功能,例如打开目录,运行工具,工具 备忘命令。 |
Online_tools | 0.5.0 | 该工具是一个集成了非常多渗透测试工具,类似软件商城的工具可以进 行工具下载,工具的更新,工具编写了自动化的安装脚本,不用担心工具 跑不起来。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
ARL-Finger-ADD | 灯塔(最新版)指纹添加脚本! |
项目名称 | 版本 | 项目描述 |
---|---|---|
burp-awesome-tls | v1.1.0 | Fixes Burp Suite's poor TLS stack. Bypass WAF, spoof any brows er. |
项目名称 | 版本 | 项目描述 |
---|---|---|
BurpCRLFScan | 1.4 | 使用java编写的CRLF-Injection-burp被动扫描插件 |
JsonDetect | v1.0 | A burp Extender to detect json, include fastjson,jackson,gson |
Sylas | 1.1.1 | 新一代子域名主/被动收集工具 - Subdomain automatic/passive coll ection tool |
Log4j-check | log4J burp被扫插件、CVE-2021-44228、支持dnclog.cn和burp内置DNS 、可配合JNDIExploit生成payload |
|
shiro-check | shiroch ek3.0 |
Shiro反序列化回显利用、内存shell、检查 Burp插件 |
GadgetProbe | v1.0 | Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpa ths. |
burp-api-drops | burp插件开发指南 | |
domain_hunter | v1.5 | A Burp Suite Extension that try to find all sub-domain, simila r-domain and related-domain of an organization automatically! 基于流量自动收集整个企业或组织的子域名、相似域名、相关域名的burp 插件 |
domain_hunter_pro | v1.9 | domain_hunter的高级版本,SRC挖洞、HW打点之必备!自动化资产收集 ;快速Title获取;外部工具联动;等等 |
knife | v2.2 | A burp extension that add some useful function to Context Menu 添加一些右键菜单让burp用起来更顺畅 |
reCAPTCHA/blob | ||
captcha-killer | 0.1.2 | burp验证码识别接口调用插件 |
chunked-coding-co nverter |
0.4.0 | Burp suite 分块传输辅助插件 |
passive-scan-clie nt |
0.3.1 | Burp被动扫描流量转发插件 |
sqlmap4burp-plus- plus |
0.2 | sqlmap4burp++是一款兼容Windows,mac,linux多个系统平台的Burp与 sqlmap联动插件 |
JC-AntiToken | burp插件:python版,token防重放绕过 | |
HackBar | 2.0 | HackBar plugin for Burpsuite |
BpScan | 1.0.0 | 一款用于辅助渗透测试工程师日常渗透测试的Burp被动漏扫插件 |
burp-cph | 3.0 | Custom Parameter Handler extension for Burp Suite. |
autoDecoder | 0.34 | Burp插件,根据自定义来达到对数据包的处理(适用于加解密、爆破等 ),类似mitmproxy,不同点在于经过了burp中转,在自动加解密的基础 上,不影响APP、网站加解密正常逻辑等。 |
captcha-killer-mo dified |
0.24.2 | captcha-killer的修改版,支持关键词识别base64编码的图片,添加免 费ocr库,用于验证码爆破,适配新版Burpsuite |
log4j2burpscanner | 0.25.0 | CVE-2021-44228 Log4j2 BurpSuite Scanner,Customize ceye.io api or other apis,including internal networks |
RouteVulScan | RouteVu lScan1.5 |
Burpsuite - Route Vulnerable Scanning 递归式被动检测脆弱路径的 burp插件 |
BurpSuiteCn | ||
semgrepper | v1.3 | An extension to use Semgrep inside Burp Suite. |
BurpBountyPlus | 3 | BurpBounty 魔改版本 |
HaE | 2.4.6 | HaE - Highlighter and Extractor, 赋能白帽 高效作战 |
base64encode | 1.0 | burpsuite POST数据包base64编码插件 |
BurpJSLinkFinder | Burp Extension for a passive scanning JS files for endpoint li nks. |
|
Burp_AES_Plugin | Burpsuite Plugin For AES Crack | |
OutLook | ||
FastjsonScan | 1.0 | 一个简单的Fastjson反序列化检测burp插件 |
SpringScan | V1.7 | SpringScan 漏洞检测 Burp插件 |
BurpSuite-collect ions |
有关burpsuite的插件(非商店),文章以及使用技巧的收集(此项目不再 提供burpsuite破解文件,如需要请在博客mrxn.net下载)---Collection o f burpsuite plugins (non-stores), articles and tips for using B urpsuite, no crack version file |
|
AutoRepeater | Automated HTTP Request Repeating With Burp Suite | |
BurpSuiteHTTPSmug gler |
v0.1 | A Burp Suite extension to help pentesters to bypass WAFs or te st their effectiveness using a number of techniques |
BurpSuiteLoggerPl usPlus |
||
PowerScanner | 1.1.3 | 面向HW的红队半自动扫描器 |
BurpExtractor | v1.3.4 | A Burp extension for generic extraction and reuse of data with in HTTP requests and responses. |
JustC2file | v1.0.2 | Burp插件,Malleable C2 Profiles生成器;可以通过Burp代理选中请 求,生成Cobalt Strike的profile文件(CSprofile) |
BurpFastJsonScan | BurpFas tJsonSca n-2.2.2 |
一款基于BurpSuite的被动式FastJson检测插件 |
BurpShiroPassiveS can |
BurpShi roPassiv eScan-2. 0.0 |
一款基于BurpSuite的被动式shiro检测插件 |
http-request-smug gler |
||
burp-requests | v0.2.4 | Copy as requests plugin for Burp Suite |
burp-text4shell | v0.1 | Text4Shell scanner for Burp Suite |
fastjson-exp | ||
NEW_xp_CAPTCHA | 4.2 | xp_CAPTCHA(瞎跑 白嫖版) burp 验证码 识别 burp插件 |
xia_Liao | 1.6 | xia Liao(瞎料)burp插件 用于Windows在线进程/杀软识别 与 web渗 透注册时,快速生成需要的资料用来填写,资料包含:姓名、手机号、身 份证、统一社会信用代码、组织机构代码、银行卡,以及各类web语言的h ello world输出和生成弱口令字典等。 |
BurpSuite_403Bypa sser |
Burpsuite Extension to bypass 403 restricted directory | |
Burp-Non-HTTP-Ext ension |
||
HopLa | 1.2 | HopLa Burp Suite Extender plugin - Adds autocompletion suppor t and useful payloads in Burp Suite |
burpFakeIP | 1.1 | 服务端配置错误情况下用于伪造ip地址进行测试的Burp Suite插件 |
burpJsEncrypter | 0.1 | More Easier Burp Extension To Solve Javascript Front End Encry ption,一款更易使用的解决前端加密问题的Burp插件。 |
SpringVulScan | SpringV ulScan-1 .1 |
burpsuite 的Spring漏洞扫描插件。SpringVulScan:支持检测:路由 泄露 |
TsojanScan | v1.4.4 | 一个集成的BurpSuite漏洞探测插件 |
BurpSuite-Extende r-fastjson |
Reference:https://www.w2n1ck.com/article/44/ | |
OneScan | v1.4.0 | OneScan是递归目录扫描的BurpSuite插件 |
HackTools | 1.5 | 提高渗透测试效率。#Burp插件##渗透测试##小工具# |
BurpSuite-Xkeys | A Burp Suite Extension to extract interesting strings (key, se cret, token, or etc.) from a webpage. |
|
npscrack | npscrac k-1.0 |
蓝队利器、溯源反制、NPS 漏洞利用、NPS exp、NPS poc、Burp插件、 一键利用 |
HostHeaderAttack | 0.1.1 | 检测host头攻击的Burpsuite被动扫描插件,Burpsuite passive scann ing plugin responsible for detecting host header attack |
BurpCrypto | BurpCrypto is a collection of burpsuite encryption plug-ins, s upport AES/RSA/DES/ExecJs(execute JS encryption code in burpsui te). 支持多种加密算法或直接执行JS代码的用于爆破前端加密的BurpSu ite插件 |
|
Log4j2Scan | dev-202 30804T02 5448 |
Log4j2 RCE Passive Scanner plugin for BurpSuite |
passive-scan-clie nt-plus |
v0.4.12 .0 |
burpsuite passive-scan-client 插件维护分支 |
sweetPotato | version 1.6 |
基于burpsuite的资产分析工具 |
fastjsonScan | fastjson漏洞burp插件,检测fastjson<1.2.68基于dnslog,fastjson< =1.2.24和1.2.33<=fatjson<=1.2.47的不出网检测和TomcatEcho,Spring Echo回显方案。 |
|
CORSScanner | CORS 跨域漏洞 burp 插件 | |
Fastjson-Scanner | a burp extension to find where use fastjson | |
taborator | A Burp extension to show the Collaborator client in a tab | |
collaborator-ever ywhere |
A Burp Suite Pro extension which augments your proxy traffic b y injecting non-invasive headers designed to reveal backend sys tems by causing pingbacks to Burp Collaborator |
|
awesome-burp-exte nsions |
A curated list of amazingly awesome Burp Extensions | |
BurpCollaboratorD NSTunnel |
A DNS tunnel utilizing the Burp Collaborator | |
LoggerPlusPlus | v3.20.0 | Advanced Burp Suite Logging Extension |
awesome-burp-suit e |
Awesome Burp Suite Resources. 400+ open source Burp plugins, 4 00+ posts and videos. |
|
blackboxprotobuf | Blackbox protobuf is a Burp Suite extension for decoding and m odifying arbitrary protobuf messages without the protobuf type definition. |
|
BurpBounty | BurpBou nty_v4.0 |
Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to im prove the active and passive scanner by means of person |
burp-bounty | Burp Bounty profiles | |
burp-wildcard | 1.08 | Burp extension intended to compact Burp extension tabs by hija cking them to own tab. |
AES-Killer | v4.0 | Burp Plugin to decrypt AES encrypted traffic on the fly |
BurpSuite-Asset_D iscover |
Burp Suite extension to discover assets from HTTP response. | |
burp-UnicodeAutoD ecode |
Burpsuite插件,Unicode自动转码为中文,提高测试效率。 | |
CaA | 0.5 | CaA - BurpSuite Collector and Analyzer |
checkburp | Detect burp | |
generator-burp-ex tension |
Everything you need about Burp Extension Generation | |
upload-scanner | HTTP file upload scanner for Burp Proxy | |
inql | v5.0.2 | InQL is a robust, open-source Burp Suite extension for advance d GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration. |
J2EEScan | v2.0.0 | J2EEScan is a plugin for Burp Suite Proxy. The goal of this pl ugin is to improve the test coverage during web application pen etration tests on J2EE applications. |
Jsdir | Jsdir is a Burp Suite extension that extracts hidden paths fro m js files and beautifies it for further reading. |
|
JSONP-Hunter | JSONP Hunter in burpsuite. | |
Burp2Malleable | Quick python utility I wrote to turn HTTP requests from burp s uite into Cobalt Strike Malleable C2 profiles |
|
SQL-Injection-Pay loads |
SQL Injection Payloads for Burp Suite, OWASP Zed Attack Proxy, ... |
|
ssrf-king | v1.12 | SSRF plugin for burp Automates SSRF Detection in all of the Re quest |
Brida | v0.6pre | The new bridge between Burp Suite and Frida! |
turbo-intruder | 1.0.19 | Turbo Intruder is a Burp Suite extension for sending large num bers of HTTP requests and analyzing the results. |
Wsdler | 2.0.12 | WSDL Parser extension for Burp |
xia_sql | 3.3 | xia SQL (瞎注) burp 插件 ,在每个参数后面填加一个单引号,两个 单引号,一个简单的判断注入小插件。 |
wooyun-payload | 1.0 | 从wooyun中提取的payload,以及burp插件 |
BurpCollect | 基于BurpCollector的二次开发, 记录Burpsuite Site Map记录的里的 数据包中的目录路径参数名信息,并存入Sqlite,并可导出txt文件。 |
|
Caidao-AES-Versio n |
一个Burp插件,实现用AES算法透明加密原版菜刀Caidao.exe与服务器 端交互的http数据流 |
|
jsEncrypter | 0.3.2 | 一个用于前端加密Fuzz的Burp Suite插件 |
HTTPHeadModifer | v0.1 | 一款快速修改HTTP数据包头的Burp Suite插件 |
项目名称 | 版本 | 项目描述 |
---|---|---|
SharkExec | 内网渗透 | |
geacon_pro | ||
LSTAR | v2.1 | LSTAR - CobaltStrike 综合后渗透插件 |
taowu-cobalt-stri ke |
||
Registry-Recon | Cobalt Strike Aggressor Script that Performs System/AV/EDR Rec on |
|
RedWarden | Cobalt Strike C2 Reverse proxy that fends off Blue Teams, AVs, EDRs, scanners through packet inspection and malleable profile correlation |
|
malleable-c2 | Cobalt Strike Malleable C2 Design and Reference Guide | |
csbruter | Cobalt Strike team server password brute force tool | |
EventLogMaster | Cobalt Strike插件 - RDP日志取证&清除 | |
Cobalt_Strike_wik i |
Cobalt Strike系列 | |
CVE-2022-39197 | CobaltStrike <= 4.7.1 RCE | |
Erebus | V1.3.6 | CobaltStrike后渗透测试插件 |
项目名称 | 版本 | 项目描述 |
---|---|---|
fofa_GUI | v1.0.0 | |
fofa_viewer | 1.1.13 | A simple FOFA client written in JavaFX. Made by WgpSec, Mainta ined by f1ashine. |
fofax | v0.1.44 | fofax is a command line query tool based on the API of https:/ /fofa.info/, simple is the best! |
项目名称 | 版本 | 项目描述 |
---|---|---|
frida-skeleton | v2.0.0 | 基于frida的安卓hook框架,提供了很多frida自身不支持的功能,将ho ok安卓变成简单便捷,人人都会的事情 |
项目名称 | 版本 | 项目描述 |
---|---|---|
frpCracker | v0.1 | 一款golang编写的,批量检测frp server未授权访问、弱token的工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Library-POC | 基于Pocsuite3、goby编写的漏洞poc&exp存档 |
项目名称 | 版本 | 项目描述 |
---|---|---|
mipsAudit | IDA MIPS静态扫描脚本,汇编审计辅助脚本 | |
IDA-Pro-tips | IDA Pro每周小技巧 | |
AlphaGolang | IDApython Scripts for Analyzing Golang Binaries | |
ida_python_extrac tCode |
ida提取特征码脚本 |
项目名称 | 版本 | 项目描述 |
---|---|---|
NessusReportInChi nese |
半自动化将 Nessus 英文报告(csv格式)生成中文 excel ,中文漏洞 库已有700多条常见漏洞,后续再进一步加上新漏洞自动翻译,实现全自 动化 |
|
NessusToReport | v1.2 | Nessus扫描报告自动化生成工具 |
CN_Nessus_Plugins _Interface |
1 | nessus插件中文查询接口 |
nessus_api | Nessus REST API 封装 | |
docker_nessus_unl imited |
docker build nessus with unlimited ip |
项目名称 | 版本 | 项目描述 |
---|---|---|
NucleiTP | ||
nucleix | 整合nuclei与xray(社区版、自带高级版),实现被动扫描+poc扫描自动 化渗透流程 |
|
nuclei-plus | v7.0.0 | Functional enhancement based on nuclei |
项目名称 | 版本 | 项目描述 |
---|---|---|
pocassistdb | 1.0.2 | database of pocassist(漏洞库) |
项目名称 | 版本 | 项目描述 |
---|---|---|
ExpToPocsuite3 | v1.0 | goby exp批量转换为pocsuite3 exp脚本 |
some_pocsuite | 用于漏洞排查的pocsuite3验证POC代码 |
项目名称 | 版本 | 项目描述 |
---|---|---|
RSAS-Data-Export | 2022-9- 9 |
绿盟极光远程安全评估系统(RSAS)-RSAS漏洞数据导出工具 |
RSAS-Task-Release | v1.0 | 绿盟极光远程安全评估系统(RSAS)-RSAS批量下任务工具 |
nsfocus-rsas-know ledge-base |
绿盟科技漏洞扫描器(RSAS)漏洞库 |
项目名称 | 版本 | 项目描述 |
---|---|---|
tool-for-CTF | Virtual machine configuration for CTF |
项目名称 | 版本 | 项目描述 |
---|---|---|
super-xray | 1.7 | Web漏洞扫描工具XRAY的GUI启动器 |
Xray_Cracked | v1.9.11 | Update Xray1.9.11 Cracked for Windows,Linux and Mac OS. |
xray-poc-generati on |
🧬 辅助生成 XRay YAML POC | |
yarx | v0.2.0 | An awesome reverse engine for xray poc. |
项目名称 | 版本 | 项目描述 |
---|---|---|
ZoomEye-go | v1.5 | The Golang SDK and CLI of ZoomEye@Knownsec by gyyyy. |
Kunyu | v1.7.2 | Kunyu, more efficient corporate asset collection |
ZoomEye-python | v2.2.0 | ZoomEye-python: The official Python library and CLI by Knownse c 404 Team. |
项目名称 | 版本 | 项目描述 |
---|---|---|
anti-honeypot | 一款可以检测WEB蜜罐并阻断请求的Chrome插件 | |
superSearchPlus | 谷歌插件版本- superSearchPlus是聚合型信息收集插件,支持综合查 询,资产测绘查询,信息收集 敏感信息提取 js资源扫描 目录扫描 vue 组件扫描 整合了目前常见的资产测绘平台 同时支持数据导出 |
|
SwitchyOmega | v2.5.20 | Manage and switch between multiple proxies quickly & easily. |
untrusted-types | 1.1.1 | |
fofa_view | v0.0.5 | FOFA Pro view 是一款FOFA Pro 资产展示浏览器插件,目前兼容 Chro me、Firefox、Opera。 |
Heimdallr | ||
Zoomeye-Tools | Zoomeye Tools是配合Zoomeye使用的Chrome插件 | |
Hack-Tools | 0.5.0 | The all-in-one Red Team extension for Web Pentester 🛠 |
mitaka | v1.4.1 | A browser extension for OSINT search |
项目名称 | 版本 | 项目描述 |
---|---|---|
penetration-suite -toolkit |
v4.0 | 本项目制作的初衷是帮助渗透新手快速搭建工作环境,工欲善其事,必 先利其器。 |
TranSec | transec os1.0 |
Internet of Vehicles Penetration testing OS. An out of the box testing environment that includes hundreds of commonly used to olsets for penetration testing of the Internet of Vehic |
项目名称 | 版本 | 项目描述 |
---|---|---|
RedTeamTools | 分享红队常用的工具 | |
All-Defense-Tool | 本项目集成了全网优秀的攻防武器工具项目,包含自动化利用,子域名 、目录扫描、端口扫描等信息收集工具,各大中间件、cms漏洞利用工具 ,爆破工具、内网横向及免杀、社工钓鱼以及应急响应等资料。 |
|
404StarLink | 404StarLink - 推荐优质、有意义、有趣、坚持维护的安全开源项目 | |
About-Attack | 一个旨在通过应用场景 / 标签对 Github 红队向工具 / 资源进行分类 收集,降低红队技术门槛的手册【持续更新】 |
|
Scanners-Box | A powerful and open-source toolkit for hackers and security au tomation - 安全行业从业者自研开源扫描器合辑 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Threathunting-boo k |
||
PenetrationTestti ps |
渗透测试Tips - Version1.3 | |
1earn | 暂停维护 | |
Pentools-wiki | 先是渗透工具合集,其次是wiki,做点不一样的x | |
Intranet_Penetrat ion_Tips |
2018年初整理的一些内网渗透TIPS,后面更新的慢,所以整理出来希望 跟小伙伴们一起更新维护~ |
|
Awesome-Redteam | 一个攻防知识仓库 | |
Vuln-List | (持续更新)对网上出现的各种OA、中间件、CMS等漏洞进行整理,主要 包括漏洞介绍、漏洞影响版本以及漏洞POC/EXP等,并且会持续更新。 |
|
SecurityInterview Guide |
网络信息安全从业者面试指南 |
项目名称 | 版本 | 项目描述 |
---|---|---|
PasswordDic | 2011-2019年Top100弱口令密码字典 Top1000密码字典 服务器SSH/VPS 密码字典 后台管理密码字典 数据库密码字典 子域名字典 |
|
Dictionary-Of-Pen testing |
Dictionary collection project such as Pentesing, Fuzzing, Brut eforce and BugBounty. 渗透测试、SRC漏洞挖掘、爆破、Fuzzing等字 典收集项目。 |
|
Dirpath_List | Dirpath_List 目录扫描字典 | |
AboutSecurity | v2 | Everything for pentest. |
JavaFileDict | Java应用的一些配置文件字典,来源于公开的字典与平时收集 | |
fuzzDicts | Web Pentesting Fuzz 字典,一个就够了。 | |
wpa-dictionary | WPA/WPA2 密码字典,用于 wifi 密码暴力破解 | |
Blasting_dictiona ry |
爆破字典 | |
bottleneckOsmosis | 瓶颈渗透,web渗透,red红队,fuzz param,注释,js字典,ctf | |
SaiDict | 弱口令,敏感目录,敏感文件等渗透测试常用攻击字典 | |
BurpCollector | 通过BurpSuite来构建自己的爆破字典,可以通过字典爆破来发现隐藏 资产。 |
|
name-fuzz | 针对目标已知信息的字典生成工具 | |
gendict | v1.0.5 | 字典生成工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Mobile-Security-F ramework-MobSF |
v3.7.6 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware a nalysis and security assessment framework capable of pe |
ApkAnalyser | 一键提取安卓应用中可能存在的敏感信息。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
IPSearch | v0.1 | 离线IP Whois查询工具。可根据IP查询所属IP段信息、根据关键词查询 IP段信息 |
项目名称 | 版本 | 项目描述 |
---|---|---|
iplookup | v1.1 | IP反查域名 |
reverseip_py | Domain Parser for IPAddress.com Reverse IP Lookup |
项目名称 | 版本 | 项目描述 |
---|---|---|
identYwaf | Blind WAF identification tool |
项目名称 | 版本 | 项目描述 |
---|---|---|
portscan | ||
TXPortMap | v1.1.2 | Port Scanner & Banner Identify From TianXiang |
yujianportscan | 一个基于VB.NET + IOCP模型开发的高效端口扫描工具,支持IP区间合 并,端口区间合并,端口指纹深度探测 |
|
webfinder-next | 对小米范webfinder http://www.cnblogs.com/SEC-fsq/p/5610981.htm l 进行了小修改 |
|
naabu | v2.2.0 | A fast port scanner written in go with a focus on reliability and simplicity. Designed to be used in combination with other t ools for attack surface discovery in bug bounties and p |
scaninfo | v1.1.0 | fast scan for redtools |
项目名称 | 版本 | 项目描述 |
---|---|---|
ipInfoSearch | ip域名反查、权重查询以及ICP备案查询。便于提交SRC时资产过滤。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
rad | 1.0 | |
Dirscan | v.1.5.2 | Dirscan是一款由go编写的高性能、高并发的目录扫描器,现在已经支 持GET、HEAD、递归扫描、代理、爬虫等功能功能,后续努力实现更多功能 。 |
cansina | 1.0.0 | Web Content Discovery Tool |
feroxbuster | v2.10.1 | A fast, simple, recursive content discovery tool written in Ru st. |
ffuf | v2.1.0 | Fast web fuzzer written in Go |
yjdirscan | yjdirsc an |
御剑目录扫描专业版,简单实用的命令行网站目录扫描工具,支持爬虫 、fuzz、自定义字典、字典变量、UA修改、假404自动过滤、扫描控速等 功能。 |
dirmap | An advanced web directory & file scanning tool that will be mo re powerful than DirBuster, Dirsearch, cansina, and Yu Jian.一 个高级web目录、文件扫描工具,功能将会强于DirBuster、Dirsearch、c ansina、御剑。 |
|
yuhScan | v1.0 | web目录快速扫描工具 |
gospider | v1.1.6 | Gospider - Fast web spider written in Go |
dirsearch_bypass4 03 |
v0.2 | 目录扫描+JS文件中提取URL和子域+403状态绕过+指纹识别 |
BBScan | v1.5 | A fast vulnerability scanner |
dirsearch | v0.4.3 | Web path scanner |
URLFinder | 2023.9. 9 |
一款快速、全面、易用的页面信息提取工具,可快速发现和提取页面中 的JS、URL和敏感信息。 |
urlbrute | v1.0.2 | Directory/Subdomain scanner developed in GoLang. |
SWebScan | 5.0.201 8.08.21 |
SWebScan是一款基于C#的Web目录扫描器。 |
JSFinder | JSFinder is a tool for quickly extracting URLs and subdomains from JS files on a website. |
|
ihoneyBakFileScan _Modify |
批量网站备份文件扫描器,增加文件规则,优化内存占用 |
项目名称 | 版本 | 项目描述 |
---|---|---|
IEyes | v0.1.2 | icp备案查询 |
ENScan_GO | 0.0.15 | 一款基于各大企业信息API的工具,解决在遇到的各种针对国内企业信 息收集难题。一键收集控股公司ICP备案、APP、小程序、微信公众号等信 息聚合导出。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
wxapkgUnpack | 1.0 | wxapkg解密解包工具,提供C#和wxappUnpacker两个版本的解包,并提 取JS中的URL和IP。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
EmailAll | EmailAll is a powerful Email Collect tool — 一款强大的邮箱收 集工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
QueryTools | IP/域名资产验证神器(补天 |
项目名称 | 版本 | 项目描述 |
---|---|---|
ObserverWard | v2023.1 1.29 |
Cross platform community web fingerprint identification tool |
14Finger | V1.1 | 功能齐全的Web指纹识别和分享平台,基于vue3+django前后端分离的web 架构,并集成了长亭出品的rad爬虫的功能,内置了一万多条互联网开源 的指纹信息。 |
Finger | 一款红队在大量的资产中存活探测与重点攻击系统指纹探测工具 | |
EHole | v3.1 | EHole(棱洞)3.0 重构版-红队重点攻击系统指纹探测工具 |
LazyDog | 1.1 | LazyDog是一款通过网络空间测绘引擎读取资产并进行指纹识别的工具 |
Find-SomeThing | 红队批量脆弱点搜集工具 | |
wappalyzergo | v0.0.10 9 |
A high performance go implementation of Wappalyzer Technology Detection Library |
Glass | Glass是一款针对资产列表的快速指纹识别工具,通过调用Fofa/ZoomEy e/Shodan/360等api接口快速查询资产信息并识别重点资产的指纹,也可 针对IP/IP段或资产列表进行快速的指纹识别。 |
|
TideFinger | TideFinger——指纹识别小工具,汲取整合了多个web指纹库,结合了 多种指纹检测方法,让指纹检测更快捷、准确。 |
|
WhatWeb | v0.5.5 | Next generation web scanner |
whatweb-plus | v0.5.5. 19.fix |
whatweb 增强版 8000+插件(提供windows可执行文件) |
FingerprintHub | default | 侦查守卫(ObserverWard)的指纹库 |
rules | 通用的指纹识别规则 |
项目名称 | 版本 | 项目描述 |
---|---|---|
koko-moni | v0.0.1 | 一个网络空间搜索引擎监控平台,可定时进行资产信息爬取,及时发现 新增资产,本项目聚合了 Fofa、Hunter、Quake、Zoomeye 和 Threatboo k 的数据源,并对获取到的数据进行去重与清洗 |
InfoSearchAll | ||
Search_Viewer | v3.0 | 集Fofa、Hunter鹰图、Shodan、360 quake、Zoomeye 钟馗之眼、censy s 为一体的空间测绘gui图形界面化工具,支持一键采集爬取和导出fofa 、shodan等数据,方便快捷查看 |
TKHunter | TKHunte r-v1.8 |
一个基于JavaFX写的一个Hunter资产测绘平台的图形化工具 |
fshzqSearch | ||
AsamF | v0.2.5 | AsamF是集成Fofa、Quake、Hunter、Shodan、Zoomeye、Chinaz、0.zon e及爱企查的一站式企业信息资产收集、网络资产测绘工具。 |
0_zone_tool | 零零信安api信息系统查询脚本 | |
ThunderSearch | v2.5.1 | 【支持Fofa、Shodan、Hunter、Zoomeye、Quake网络空间搜索引擎】闪 电搜索器;GUI图形化(Mac/Windows)渗透测试信息搜集工具;资产搜集引 擎;hw红队工具hvv |
ones | v1.0.4 | 可用于多个网络资产测绘引擎 API 的命令行查询工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
ksubdomain | v1.9.5 | Subdomain enumeration tool, asynchronous dns packets, use pcap to scan 1600,000 subdomains in 1 second |
LayerDomainFinder | 3 | Layer子域名挖掘机 |
github-subdomains | v1.2.2 | Find subdomains on GitHub. |
ct | v1.0.9 | 简单易用的域名爆破工具 |
ksubdomain | v0.7 | 无状态子域名爆破工具 |
LangSrcCurise | SRC子域名资产监控 | |
subDomainsBrute | v1.4 | A fast sub domain brute tool for pentesters |
subfinder | v2.6.3 | Fast passive subdomain enumeration tool. |
OneForAll | v0.4.5 | OneForAll是一款功能强大的子域收集工具 |
dnsub | v2.1 | dnsub一款好用且强大的子域名扫描工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
ShuiZe_0x727 | v1.0 | 信息收集自动化工具 |
AnScan | AnScan是一款集合信息收集、分布式漏洞扫描、漏洞POC管理等为一体 的红队扫描工具 |
|
linglong | 一款甲方资产巡航扫描系统。系统定位是发现资产,进行端口爆破。帮 助企业更快发现弱口令问题。主要功能包括: 资产探测、端口爆破、定时 任务、管理后台识别、报表展示 |
|
slime | Slime是一个组合众多优秀安全工具的漏扫软件,它将目光集中在安全 工具的组合上,而不是自己实现漏扫的某一流程。 |
|
vulcat | v2.0.0 | vulcat可用于扫描Web端常见的CVE、CNVD等编号的漏洞,发现漏洞时会 返回Payload信息。部分漏洞还支持命令行交互模式,可以持续利用漏洞 |
bayonet | v1.1 | bayonet是一款src资产管理系统,从子域名、端口服务、漏洞、爬虫等 一体化的资产管理系统 |
GoScan | GoScan是采用Golang语言编写的一款分布式综合资产管理系统,适合红 队、SRC等使用 |
|
Watchdog | Watchdog是bayonet修改版,重新优化了数据库及web及扫描程序,加入 多节点 |
|
MagiCude | v2.1 | 分布式端口(漏洞)扫描、资产安全管理、实时威胁监控与通知、高效 漏洞闭环、漏洞wiki、邮件报告通知、poc框架 |
nemo_go | v2.10.3 | Nemo是用来进行自动化信息收集的一个简单平台,通过集成常用的信息 收集工具和技术,实现对内网及互联网资产信息的自动收集,提高隐患排 查和渗透测试的工作效率。 |
fuxi | Penetration Testing Platform | |
Sec-Tools | 🍉一款基于Python-Django的多功能Web安全渗透测试工具,包含漏洞扫 描,端口扫描,指纹识别,目录扫描,旁站扫描,域名扫描等功能。 |
|
AppInfoScanner | V1.0.9_ Releases |
一款适用于以HW行动/红队/渗透测试团队为场景的移动端(Android、iO S、WEB、H5、静态网站)信息收集扫描工具,可以帮助渗透测试工程师、 攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产 信息并提供基本的信息输出,如:Title、Domain、CDN、指纹信息、状态 信息等。 |
Komo | 🚀Komo, a comprehensive asset collection and vulnerability sca nning tool. Komo 一个综合资产收集和漏洞扫描工具,集成了20余款工 具,通过多种方式对子域进行获取,收集域名邮箱,进行存活探测,域名 指纹识别,域名反查ip,ip端口扫描,web服务链接爬取并发送给xray, 对web服务进行P |
|
mscan | 方便快捷是这款扫描器的优点,能随意修改增加模块。目前的版本功能 如下:支持子域名收集、POC批量验证、目录扫描、检测CDN、域名转IP、 主机扫描、过滤重复、检测HTTP状态、压缩程序、XRAY扫描。 |
|
H | H是一款强大的资产收集管理平台 | |
sec-admin | 分布式资产安全扫描核心管理系统(弱口令扫描,漏洞扫描) | |
linbing | v3.0 | 本系统是对Web中间件和Web框架进行自动化渗透的一个系统,根据扫描 选项去自动化收集资产,然后进行POC扫描,POC扫描时会根据指纹选择POC 插件去扫描,POC插件扫描用异步方式扫描.前端采用vue技术,后端采用pyt hon fastapi. |
Tide | 目前实现了网络空间资产探测、指纹检索、漏洞检测、漏洞全生命周期 管理、poc定向检测、暗链检测、挂马监测、敏感字检测、DNS监测、网站 可用性监测、漏洞库管理、安全预警等等~ |
|
ARL | v2.6 | ARL(Asset Reconnaissance Lighthouse)资产侦察灯塔系统旨在快速侦 察与目标关联的互联网资产,构建基础资产信息库。 协助甲方安全团队 或者渗透测试人员有效侦察和检索资产,发现存在的薄弱点和攻击面。 |
DBJ | 大宝剑-边界资产梳理工具(红队、蓝队、企业组织架构、子域名、Web 资产梳理、Web指纹识别、ICON_Hash资产匹配) |
|
Vulcan | VulCan资产管理系统 | |
X-Marshal | Marshal-EASM | |
WebScan | 正在写的一个资产管理和扫描相结合的分布式扫描器 | |
Voyager | 一个安全工具集合平台,用来提高乙方安全人员的工作效率,请勿用于 非法项目 |
|
rengine | v2.0.2 | reNgine is an automated reconnaissance framework for web appli cations with a focus on highly configurable streamlined recon p rocess via Engines, recon data correlation and organiza |
heartsk_community | LOWBUG@ Latest |
Hearts K-企业资产发现与脆弱性检查工具,自动化资产信息收集与漏 洞扫描 |
xunfeng | v0.1.1 | 巡风是一款适用于企业内网的漏洞快速应急,巡航扫描系统。 |
Autoscanner | v1.2.1 | 输入域名>爆破子域名>扫描子域名端口>发现扫描web服务>集成报告的 全流程全自动扫描器。集成oneforall、masscan、nmap、dirsearch、cra wlergo、xray等工具,另支持cdn识别、网页截图、站点定位;动态识别 域名并添加功能、工具超时中断等 |
项目名称 | 版本 | 项目描述 |
---|---|---|
TScan | TScan 提供了CMS指纹识别、端口扫描、旁站信息、信息泄漏等功能, 期许在最短的时间辅助安全人员在渗透前做好充分的信息搜集 |
|
AssetsHunter | 资产狩猎框架-AssetsHunter,信息收集是一项艺术~ | |
dismap | v0.4 | Asset discovery and identification tools 快速识别 Web 指纹信息 ,定位资产类型。辅助红队快速定位目标资产信息,辅助蓝队发现疑似脆 弱点 |
项目名称 | 版本 | 项目描述 |
---|---|---|
kube-bench | v0.6.19 | Checks whether Kubernetes is deployed according to security be st practices as defined in the CIS Kubernetes Benchmark |
项目名称 | 版本 | 项目描述 |
---|---|---|
kube-hunter | v0.6.8 | Hunt for security weaknesses in Kubernetes clusters |
项目名称 | 版本 | 项目描述 |
---|---|---|
veinmind-tools | v2.1.5 | veinmind-tools 是由长亭科技自研,基于 veinmind-sdk 打造的容器 安全工具集 |
项目名称 | 版本 | 项目描述 |
---|---|---|
trivy | v0.48.0 | Find vulnerabilities, misconfigurations, secrets, SBOM in cont ainers, Kubernetes, code repositories, clouds and more |
项目名称 | 版本 | 项目描述 |
---|---|---|
grype | v0.73.4 | A vulnerability scanner for container images and filesystems |
syft | v0.98.0 | CLI tool and library for generating a Software Bill of Materia ls from container images and filesystems |
项目名称 | 版本 | 项目描述 |
---|---|---|
clair | v4.7.2 | Vulnerability Static Analysis for Containers |
项目名称 | 版本 | 项目描述 |
---|---|---|
CDK | v1.5.2 | 📦 Make security testing of K8s, Docker, and Containerd easier . |
项目名称 | 版本 | 项目描述 |
---|---|---|
container-escape- check |
v0.3 | docker container escape check |
项目名称 | 版本 | 项目描述 |
---|---|---|
neuvector | v5.2.4 | |
ThunderCloud | Cloud Exploit Framework | |
containerd | v1.7.11 | An open and reliable container runtime |
项目名称 | 版本 | 项目描述 |
---|---|---|
metarget | v0.9.1 | Metarget is a framework providing automatic constructions of v ulnerable infrastructures. |
项目名称 | 版本 | 项目描述 |
---|---|---|
safeline | v3.15.3 | 一款足够简单、足够好用、足够强的免费 WAF。基于业界领先的语义引 擎检测技术,作为反向代理接入,保护你的网站不受黑客攻击。 |
openstar | lua waf,nginx+lua,openresty,luajit,waf+,cdn,nginx |
项目名称 | 版本 | 项目描述 |
---|---|---|
mysql-fake-server | 0.0.4 | MySQL Fake Server (纯Java实现,支持GUI版和命令行版,提供Docker file,支持多种常见JDBC利用) |
MysqlT | v1.0 | 伪造Myslq服务端,并利用Mysql逻辑漏洞来获取客户端的任意文件反击 攻击者 |
WhetherMysqlSham | v1.0 | 检测目标Mysql数据库是不是蜜罐 |
Juggler | A system that may trick hackers. 针对黑客的拟态欺骗系统。 | |
DecoyMini | v2.0.66 91 |
🐝 A highly scalable, safe, free enterprise honeypots 一款高可 扩展、安全、免费的企业级蜜罐系统 |
MySQL_Fake_Server | MySQL Fake Server use to help MySQL Client File Reading and JD BC Client Java Deserialize |
|
Ehoney | v3.0.0 | 安全、快捷、高交互、企业级的蜜罐管理系统,护网;支持多种协议蜜 罐、蜜签、诱饵等功能。A safe, fast, highly interactive and enter prise level honeypot management system, supports multiple proto col honeypots, honeytokens, baits |
MoAn_Honey_Pot_Ur ls |
X安蜜罐用的一些存在JSonp劫持的API | |
HFish | 安全、可靠、简单、免费的企业级蜜罐 | |
conpot | Release _0.6.0 |
ICS/SCADA honeypot |
CS_fakesubmit | 一个可以伪装上线Cobaltstrike的脚本 | |
ide-honeypot | 一款针对于IDE的反制蜜罐 IDE-honeypot |
项目名称 | 版本 | 项目描述 |
---|---|---|
RmEye | v0.0.4 | 戎码之眼是一个window上的基于att&ck模型的威胁监控工具.有效检测 常见的未知威胁与已知威胁.防守方的利剑 |
项目名称 | 版本 | 项目描述 |
---|---|---|
iDefender | 2.9.0 | iDefender(冰盾 - 终端主动防御系统) |
项目名称 | 版本 | 项目描述 |
---|---|---|
Elkeid | rasp-v2 .2.1.4-s canclass |
Elkeid is an open source solution that can meet the security r equirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's int |
Hades | Hades is an cross-platform HIDS with kernel-space data collect ion. |
|
cobaltstrike-suri cata-rules |
17条检测cobaltstrike的suricata-ids规则 |
项目名称 | 版本 | 项目描述 |
---|---|---|
UsbKbCracker | CTF中常见键盘流量解密脚本 | |
UsbKeyboardDataHa cker |
USB键盘流量包取证工具 , 用于恢复用户的击键信息 |
项目名称 | 版本 | 项目描述 |
---|---|---|
UsbMiceDataHacker | USB鼠标流量包取证工具 , 主要用于绘制鼠标移动以及拖动轨迹 |
项目名称 | 版本 | 项目描述 |
---|---|---|
VolatilityPro | 一款用于自动化处理内存取证的Python脚本,并提供GUI界面 | |
MemProcFS | v5.8 | MemProcFS |
volatility3 | v2.5.0 | Volatility 3.0 development |
LinuxVolProfiles | 2.0 | Volatility Linux Profiles |
community | Volatility plugins developed and maintained by the community | |
profiles | Volatility profiles for Linux and Mac OS X | |
community3 | Volatility3 plugins developed and maintained by the community |
项目名称 | 版本 | 项目描述 |
---|---|---|
SerializationDump er-Shiro |
基于SerializationDumper的Shiro Cookie序列化数据解密小工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
DecodeSomeJSPWebs hell |
v1.2 | 冰蝎、哥斯拉 jsp webshell通信流量解密器 |
webshell_detect | webshell_detect |
项目名称 | 版本 | 项目描述 |
---|---|---|
webshell_detect | webshell_detect |
####### LSB隐写
项目名称 | 版本 | 项目描述 |
---|---|---|
steganography | Simple C++ Image Steganography tool to encrypt and hide files insde images using Least-Significant-Bit encoding. |
|
stegpy | Simple steganography program based on the LSB method. | |
cloacked-pixel | LSB steganography and detection | |
####### png宽高修复 | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
Deformed-Image-Re storer |
V1.02 | 自动爆破PNG图片宽高并一键修复工具 |
####### 截图漏洞 | ||
项目名称 | 版本 | 项目描述 |
:---- | :---- | :---- |
Acropalypse-Multi -Tool |
v1.0.0 | Easily detect and restore Acropalypse vulnerable PNG and GIF f iles with simple Python GUI. |
项目名称 | 版本 | 项目描述 |
---|---|---|
BlindWaterMark | 盲水印 by python | |
blind_watermark | 0.2.1 | Blind&Invisible Watermark ,图片盲水印,提取水印无须原图! |
blind-watermark | Watermark added to the frequency domain by Fourier transform | |
BlindWatermark | v0.0.3 | Java 盲水印 |
项目名称 | 版本 | 项目描述 |
---|---|---|
ImageMagick | 7.1.1-2 3 |
🧙♂️ ImageMagick 7 |
项目名称 | 版本 | 项目描述 |
---|---|---|
stegsolve | v1.4 | |
ImageStrike | V0.2 | ImageStrike是一款用于CTF中图片隐写的综合利用工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
CRC32-Tools | 2.2 | Easy CRC32 Tools,so easy!!! |
项目名称 | 版本 | 项目描述 |
---|---|---|
ZipCenOp | ZipCenOp is a Java tool to play with Zip pseudo-encryption. |
项目名称 | 版本 | 项目描述 |
---|---|---|
audacity | Audacit y-3.4.2 |
Audio Editor |
QSSTV | Receive and transmit images over radio using analog SSTV or di gital DRM |
|
dtmf-decoder | Extract phone numbers from an audio recording of the dial tone s. |
项目名称 | 版本 | 项目描述 |
---|---|---|
qq_msg_decode | 解码qq聊天数据库 |
项目名称 | 版本 | 项目描述 |
---|---|---|
vhost_password_de crypt |
vhost password decrypt |
项目名称 | 版本 | 项目描述 |
---|---|---|
pyvmx-cracker | Simple tool to crack VMware VMX encryption passwords |
项目名称 | 版本 | 项目描述 |
---|---|---|
WIFIpass | decrypt all saved WIFI passwords on your PC |
项目名称 | 版本 | 项目描述 |
---|---|---|
Browser-cookie-st eal |
Python script for steal browser cookies | |
SharpWeb | v1.2 | .NET 2.0 CLR project to retrieve saved browser credentials fro m Google Chrome, Mozilla Firefox and Microsoft Internet Explore r/Edge. |
360SafeBrowserget pass |
v0.1 | 这是一个一键辅助抓取360安全浏览器密码的CobaltStrike脚本以及解 密小工具,用于节省红队工作量,通过下载浏览器数据库、记录密钥来离 线解密浏览器密码。 |
HackBrowserData | v0.4.4 | Decrypt passwords/cookies/history/bookmarks from the browser. 一款可全平台运行的浏览器数据导出解密工具。 |
BrowserGhost | 1 | 这是一个抓取浏览器密码的工具,后续会添加更多功能 |
Pillager | AutoBui ld |
Pillager是一个适用于后渗透期间的信息收集工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
SharpWxDump | 微信客户端取证,可获取用户个人信息(昵称/账号/手机/邮箱/数据库 密钥(用来解密聊天记录));支持获取多用户信息,不定期更新新版本偏 移,目前支持所有新版本、正式版本 |
|
chatViewTool | BEAT | 基于Java实现的图形化微信聊天记录解密查看器 |
Sharp-dumpkey | 1 | 基于C#实现的获取微信数据库密钥的小工具 |
GoWxDump | v1.0.12 | SharpWxDump的Go语言版。微信客户端取证,获取信息(微信号、手机号 、昵称),微信聊天记录分析(Top N聊天的人、统计聊天最频繁的好友排 行、关键词列表搜索等) |
PyWxDump | v2.3.11 | 获取微信账号信息(昵称/账号/手机/邮箱/数据库密钥/wxid);PC微信 数据库读取、解密脚本;聊天记录查看工具;聊天记录导出为html(包含 语音图片)。支持多账户信息获取,支持所有微信版本。 |
WeChatUserDB | GetWeChat DBPassword&&UserInfo(获取PC数据库密码以及相关微信用 户信息支持多系统数据库解密) |
|
WeChatMsg | v0.2.8 | 提取微信聊天记录,将其导出成HTML、Word、CSV文档永久保存,对聊 天记录进行分析生成年度聊天报告 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Sunflower_get_Pas sword |
一款针对向日葵的识别码和验证码提取工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Xdecrypt | Xshell Xftp password decrypt | |
SharpDPAPI | SharpDPAPI is a C# port of some Mimikatz DPAPI functionality. | |
SharpDecryptPwd | Windows常用程序密码读取工具:SharpDecryptPwd | |
SharpXDecrypt | v0.1.4 | Xshell全版本密码恢复工具 |
SharpDBeaver | DBeaver数据库密码解密工具 | |
FinalShell-Decode r |
V1.0 | FinallShell 密码解密GUI工具 |
getIntrInfo | 收集内部网信息。包括:浏览器书签、密码和浏览历史记录、cookie。 Wifi信息和密码。主机信息。 |
|
SharpDecryptPwd | SharpDecryptPwd source, To Decrypt Navicat,Xmanager,Filezilla, Foxmail,WinSCP,etc |
|
SharpDecryptPwd | 对密码已保存在 Windwos 系统上的部分程序进行解析,包括:Navicat, TeamViewer,FileZilla,WinSCP,Xmangager系列产品(Xshell,Xftp)。源 码:https://github.com/RowTeam/SharpDecryptPwd |
|
TeamViewer | TeamView Get PassWord | |
FinalShellDecodeP ass |
FinalShellDecodePass 加密解密 | |
navicat_password_ decrypt |
v2.0 | 忘记navicat密码时,此工具可以帮您查看密码 |
项目名称 | 版本 | 项目描述 |
---|---|---|
fakelogonscreen | 1.1 | Fake Windows logon screen to steal passwords |
win-brute-logon | Crack any Microsoft Windows users password without any privile ge (Guest account included) |
|
mimikatz | 2.2.0-2 0220919 |
A little tool to play with Windows security |
goLazagne | Go library for credentials recovery | |
RdpThief_tools | 窃取mstsc中的用户明文凭据 | |
LaZagne | v2.4.5 | Credentials recovery project |
项目名称 | 版本 | 项目描述 |
---|---|---|
DangerousSpamWord s |
🎶超轻量的中文敏感字、敏感词库,字典词典,超低误识别率, 另提供API调用 |
|
anti-AD | v4.3 | 致力于成为中文区命中率最高的广告过滤列表,实现精确的广告屏蔽和 隐私保护。anti-AD现已支持AdGuardHome,dnsmasq, Surge,Pi-Hole, smartdns等网络组件。完全兼容常见的广告过滤工具所支持的各种广告 过滤列表格式 |
sensitive_words | 敏感词库整理 |
项目名称 | 版本 | 项目描述 |
---|---|---|
http://www.shelldetector.com/ | ||
Webshell_finder | 网站木马检测 | |
BackdoorMan | BackdoorMan is a toolkit that helps you find malicious, hidden and suspicious PHP scripts and shells in a chosen destination. |
|
findWebshell | findWebshell是一款基于python开发的webshell检测工具。 | |
kunwu | 0.1.0 | kunwu是新一代webshell检测引擎,使用了内置了模糊规则、污点分析 模拟执行、机器学习三种高效的检测策略 |
webshell-find-too ls |
分析web访问日志以及web目录文件属性,用于根据查找可疑后门文件的 相关脚本。 |
|
as_scanwebshell | An AntSword's plugin to scan webshell | |
https://www.shellpub.com/ | ||
java-memshell-sca nner |
通过jsp脚本扫描java web Filter/Servlet型内存马 |
项目名称 | 版本 | 项目描述 |
---|---|---|
shell-analyzer | 0.1 | Java内存马查杀GUI工具,实时动态分析,支持本地和远程查杀 |
arthas | arthas- all-3.7. 1 |
Alibaba Java Diagnostic Tool Arthas/Alibaba Java诊断利器Arthas |
DuckMemoryScan | 检测绝大部分所谓的内存免杀马 | |
copagent | java memory web shell extracting tool | |
aLIEz | 杀内存马的工具,欢迎code review,提出更好的意见 | |
ASP.NET-Memshell- Scanner |
asp.net内存马检测工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
china-operator-ip | **运营商IPv4/IPv6地址库-每日更新 | |
GeoIP2-CN | 小巧精悍、准确、实用 GeoIP2 数据库 |
项目名称 | 版本 | 项目描述 |
---|---|---|
ARTIF | 1.0 | An advanced real time threat intelligence framework to identif y threats and malicious web traffic on the basis of IP reputati on and historical data. |
tig | v0.5.4 | Threat Intelligence Gathering 威胁情报收集,旨在提高蓝队拿到攻 击 IP 后对其进行威胁情报信息收集的效率。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
DarkNet_ChineseTr ading |
🚇暗网中文网监控爬虫(DEEPMIX) |
项目名称 | 版本 | 项目描述 |
---|---|---|
phishing_catcher | Phishing catcher using Certstream |
项目名称 | 版本 | 项目描述 |
---|---|---|
DLLSpy | V1 | DLL Hijacking Detection Tool |
项目名称 | 版本 | 项目描述 |
---|---|---|
LinuxCheck | V2.3 | Linux应急处置/信息搜集/漏洞检测工具,支持基础配置/网络流量/任 务计划/环境变量/用户信息/Services/bash/恶意文件/内核Rootkit/SSH/ Webshell/挖矿文件/挖矿进程/供应链/服务器风险等13类70+项检查 |
malwoverview | v5.4.2 | Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, M |
uroboros | A GNU/Linux monitoring and profiling tool focused on single pr ocesses. |
|
GScan | 本程序旨在为安全应急响应人员对Linux主机排查时提供便利,实现主 机侧Checklist的自动全面化检测,根据检测结果自动数据聚合,进行黑 客攻击路径溯源。 |
|
whohk | ||
Emergency/blob/ma ster/linux.sh |
||
yingji | 应急相关内容积累 | |
https://rkhunter.sourceforge.net/ |
项目名称 | 版本 | 项目描述 |
---|---|---|
APT-Hunter | V3.0 | APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hi dden in the sea of windows event logs to decrease the t |
windodws-logs-ana lysis |
windows日志一键分析小工具 | |
WELA | v1.0.0 | WELA (Windows Event Log Analyzer): The Swiss Army knife for Wi ndows Event Logs! ゑ羅(ウェラ) |
https://www.microsoft.com/en-us/download/details.aspx?id=24659 | ||
https://www.nirsoft.net/utils/full_event_log_view.html |
项目名称 | 版本 | 项目描述 |
---|---|---|
https://processhacker.sourceforge.io/ |
项目名称 | 版本 | 项目描述 |
---|---|---|
YDArk | X64内核小工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
https://docs.microsoft.com/zh-cn/sysinternals/downloads/ |
项目名称 | 版本 | 项目描述 |
---|---|---|
FireKylin | v1.4.0 | 🔥火麒麟-网络安全应急响应工具(系统痕迹采集)Cybersecurity emerg ency response tool.👍👍👍 |
sysmon-config | Sysmon configuration file template with default high-quality e vent tracing |
|
dfirtriage | Digital forensic acquisition tool for Windows based incident r esponse. |
|
winlog | 一款基于go的windows信息收集工具,主要收集目标机器rdp端口、msts c远程连接记录、mstsc密码和安全事件中4624、4625登录事件记录 |
项目名称 | 版本 | 项目描述 |
---|---|---|
RmTools | 蓝队应急工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
d-eyes | v1.1.0 | D-Eyes为绿盟科技一款检测与响应工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Decryption-Tools | Decryption-Tools |
项目名称 | 版本 | 项目描述 |
---|---|---|
Emergency-Respons e-Notes |
应急响应实战笔记,一个安全工程师的自我修养。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
BlueTeamTools | BlueTea mToolsV0 .89版本 |
蓝队分析研判工具箱,功能包括内存马反编译分析、各种代码格式化、 网空资产测绘功能、溯源辅助、解密冰蝎流量、解密哥斯拉流量、解密Sh iro/CAS/Log4j2的攻击payload、IP/端口连接分析、各种编码/解码功能 、蓝队分析常用网址、java反序列化数据包分析、Java类名搜索、Fofa搜 索、Hunter搜索等。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Shell_Script | v0.1 | Linux系统的安全,通过脚本对Linux系统进行一键检测和一键加固 |
项目名称 | 版本 | 项目描述 |
---|---|---|
go-pinyin | v0.20.0 | 汉字转拼音 |
项目名称 | 版本 | 项目描述 |
---|---|---|
python-pinyin | v0.49.0 | 汉字转拼音(pypinyin) |
python-small-exam ples |
告别枯燥,致力于打造 Python 实用小例子,更多Python良心教程见 P ython中文网 http://www.zglg.work |
项目名称 | 版本 | 项目描述 |
---|---|---|
common-regex | 🎃 常用正则表达式 - 收集一些在平时项目开发中经常 用到的正则表达式。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
pulumi | v3.94.1 | Pulumi - Infrastructure as Code in any programming language. B uild infrastructure intuitively on any cloud using familiar lan guages 🚀 |
trufflehog | v3.62.1 | Find and verify credentials |
dnSpy | v6.4.1 | Unofficial revival of the well known .NET debugger and assembl y editor, dnSpy |
druid | 1.2.20 | 阿里云计算平台DataWorks(https://help.aliyun.com/document_detai l/137663.html) 团队出品,为监控而生的数据库连接池 |
console | v0.41.0 | Simple UI for MinIO Object Storage 🧮 |
notify | v0.41.0 | A dead simple Go library for sending notifications to various messaging services. |
code-server | v4.18.0 | VS Code in the browser |
delve | v1.21.2 | Delve is a debugger for the Go programming language. |
protections-artif acts |
Elastic Security detection content for Endpoint | |
ruby | v3_2_2 | The Ruby Programming Language |
jadx | v1.4.7 | Dex to Java decompiler |
glpi | 10.0.10 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and sof tware auditing. |
gotestwaf | An open-source project in Golang to asess different API Securi ty tools and WAF for detection logic and bypasses |
|
yara | v4.3.2 | The pattern matching swiss knife |
gin | v1.9.1 | Gin is a HTTP web framework written in Go (Golang). It feature s a Martini-like API with much better performance -- up to 40 t imes faster. If you need smashing performance, get your |
etcd | v3.5.10 | Distributed reliable key-value store for the most critical dat a of a distributed system |
spring-framework | v6.1.0 | Spring Framework |
wekan | v7.18 | The Open Source kanban (built with Meteor). Keep variable/tabl e/field names camelCase. For translations, only add Pull Reques t changes to wekan/i18n/en.i18n.json , other translatio |
StratosphereLinux IPS |
v1.0.8 | Slips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laborat |
nuclei-templates | v9.6.9 | Community curated list of templates for the nuclei engine to f ind security vulnerabilities. |
pdns | PowerDNS Authoritative, PowerDNS Recursor, dnsdist | |
compose | v2.23.1 | Define and run multi-container applications with Docker |
AdGuardHome | v0.107. 41 |
Network-wide ads & trackers blocking DNS server |
tabby | v1.0.20 4 |
A terminal for a more modern age |
jumpserver | v3.9.0 | JumpServer 是广受欢迎的开源堡垒机,是符合 4A 规范的专业运维安 全审计系统。 |
harbor | v2.9.1 | An open source trusted cloud native registry project that stor es, signs, and scans content. |
HikariCP | 光 HikariCP・A solid, high-performance, JDBC connection pool a t last. |
|
scrapy | 2.11.0 | Scrapy, a fast high-level web crawling & scraping framework fo r Python. |
falco | 0.36.2 | Cloud Native Runtime Security |
suricata | suricat a-7.0.2 |
Suricata is a network Intrusion Detection System, Intrusion Pr evention System and Network Security Monitoring engine develope d by the OISF and the Suricata community. |
yakit | v1.2.7- sp4 |
Cyber Security ALL-IN-ONE Platform |
pwndbg | 2023.07 .17 |
Exploit Development and Reverse Engineering with GDB Made Easy |
aliyun-cli | v3.0.18 8 |
Alibaba Cloud CLI |
Microsoft-Activat ion-Scripts |
2.5 | A Windows and Office activator using HWID / Ohook / KMS38 / On line KMS activation methods, with a focus on open-source code a nd fewer antivirus detections. |
commix | v3.8 | Automated All-in-One OS Command Injection Exploitation Tool. |
sharry | v1.12.1 | Sharry is a self-hosted file sharing web application. |
APT_REPORT | Interesting APT Report Collection And Some Special IOC | |
monkey | v2.3.0 | Infection Monkey - An open-source adversary emulation platform |
zmap | v3.0.0 | ZMap is a fast single packet network scanner designed for Inte rnet-wide network surveys. |
Nuitka | Nuitka is a Python compiler written in Python. It's fully comp atible with Python 2.6, 2.7, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10 , and 3.11. You feed it your Python app, it does a lot |
|
masscan | 1.3.2 | TCP port scanner, spews SYN packets asynchronously, scanning e ntire Internet in under 5 minutes. |
dfimage | Reverse-engineer a Dockerfile from a Docker image. | |
theHarvester | 4.4.4 | E-mails, subdomains and names Harvester - OSINT |
alt-tab-macos | v6.64.0 | Windows alt-tab on macOS |
phpmyadmin | RELEASE _5_2_1 |
A web interface for MySQL and MariaDB |
sdk-api | Public contributions for win32 API documentation | |
static-analysis | ⚙️ A curated list of static analysis (SAST) tools and linter s for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality. |
|
terraform | v1.6.4 | Terraform enables you to safely and predictably create, change , and improve infrastructure. It is a source-available tool tha t codifies APIs into declarative configuration files th |
sslh | Applicative Protocol Multiplexer (e.g. share SSH and HTTPS on the same port) |
|
btop | v1.2.13 | A monitor of resources |
qrazybox | QR Code Analysis and Recovery Toolkit | |
fish-shell | 3.6.1 | The user-friendly command line shell. |
rich | v13.7.0 | Rich is a Python library for rich text and beautiful formattin g in the terminal. |
rundeck | v4.17.3 | Enable Self-Service Operations: Give specific users access to your existing tools, services, and scripts |
pyscript | 2023.11 .1 |
Home Page: https://pyscript.net Examples: https://pyscript.net /examples |
LogonTracer | v1.6.1 | Investigate malicious Windows logon by visualizing and analyzi ng Windows event log |
QEMU | Official QEMU mirror. Please see https://www.qemu.org/contribu te/ for how to submit changes to QEMU. Pull Requests are ignore d. Please only use release tarballs from the QEMU websi |
|
CotEditor | 4.6.5 | Lightweight Plain-Text Editor for macOS |
cas | v6.6.13 | Apereo CAS - Identity & Single Sign On for all earthlings and beyond. |
krbrelayx | Kerberos unconstrained delegation abuse toolkit | |
aria2 | release -1.37.0 |
aria2 is a lightweight multi-protocol & multi-source, cross pl atform download utility operated in command-line. It supports H TTP/HTTPS, FTP, SFTP, BitTorrent and Metalink. |
upx | v4.2.1 | UPX - the Ultimate Packer for eXecutables |
CycleTLS | Spoof TLS/JA3 fingerprints in GO and Javascript | |
PostgresApp | v2.6.8a | The easiest way to get started with PostgreSQL on the Mac |
nacos | 2.2.3 | an easy-to-use dynamic service discovery, configuration and se rvice management platform for building cloud native application s. |
photon | 5.0-GA | Minimal Linux container host |
DongTai | v1.16.0 | Dongtai IAST is an open-source Interactive Application Securit y Testing (IAST) tool that enables real-time detection of commo n vulnerabilities in Java applications and third-party |
pwcrack-framework | 1.21.0 | Password Crack Framework |
wabt | 1.0.34 | The WebAssembly Binary Toolkit |
garble | v0.10.1 | Obfuscate Go builds |
onedrive_user_enu m |
onedrive user enumeration - pentest tool to enumerate valid o3 65 users |
|
tmux | 3.3a | tmux source code |
sslscan | 2.1.2 | sslscan tests SSL/TLS enabled services to discover supported c ipher suites |
nmap | Nmap - the Network Mapper. Github mirror of official SVN repos itory. |
|
CSS-Exchange | v23.11. 14.1759 |
Exchange Server support tools and scripts |
TREVORspray | TREVORspray is a modular password sprayer with threading, clev er proxying, loot modules, and more! |
|
broot | v1.28.1 | A new way to see and navigate directory trees : https://dystro y.org/broot |
dnscrypt-proxy-co nfig |
||
mitmproxy | 10.1.5 | An interactive TLS-capable intercepting HTTP proxy for penetra tion testers and software developers. |
goreleaser | v1.22.1 | Deliver Go binaries as fast and easily as possible |
f8x | 1.6.2 | 红/蓝队环境自动化部署工具 |
signature-base | v2.0 | YARA signature and IOC database for my scanners and tools |
usql | v0.16.0 | Universal command-line interface for SQL databases |
csprecon | v0.0.8 | Discover new target domains using Content Security Policy |
yq | v4.35.2 | yq is a portable command-line YAML, JSON, XML, CSV, TOML and p roperties processor |
gmssl | v3.2.2 | a python crypto for sm2/sm3/sm4 |
python-codext | Python codecs extension featuring CLI tools for encoding/decod ing anything |
|
mapcidr | v1.1.15 | Utility program to perform multiple operations for a given sub net/CIDR ranges. |
miniforge | 23.3.1- 1 |
A conda-forge distribution. |
celery | v5.3.5 | Distributed Task Queue (development branch) |
Mythic | v3.1.0 | A collaborative, multi-platform, red teaming framework |
MQTTX | v1.9.6 | A Powerful and All-in-One MQTT 5.0 client toolbox for Desktop, CLI and WebSocket. |
httpx | v1.3.7 | httpx is a fast and multi-purpose HTTP toolkit that allows run ning multiple probes using the retryablehttp library. |
coreruleset | v3.3.5 | OWASP ModSecurity Core Rule Set (Official Repository) |
MoreFind | v1.5.5 | 一款用于快速导出URL、Domain和IP的小工具 |
easy-rsa | v3.1.7 | easy-rsa - Simple shell based CA utility |
PayloadsAllTheThi ngs |
3.0 | A list of useful payloads and bypass for Web Application Secur ity and Pentest/CTF |
ezXSS | 4.1 | ezXSS is an easy way for penetration testers and bug bounty hu nters to test (blind) Cross Site Scripting. |
fzf | 0.44.0 | 🌸 A command-line fuzzy finder |
DSInternals | v4.12 | Directory Services Internals (DSInternals) PowerShell Module and Framework |
gmpy | gmpy2-2 .1.5 |
General Multi-Precision arithmetic for Python 2.6+/3+ (GMP, MP IR, MPFR, MPC) |
gmhelper | 基于BC库:国密SM2/SM3/SM4算法简单封装;实现SM2 X509v3证书的签 发;实现SM2 pfx证书的签发 |
|
gopsutil | v3.23.1 0 |
psutil for golang |
ttyd | 1.7.4 | Share your terminal over the web |
dnsx | v1.1.6 | dnsx is a fast and multi-purpose DNS toolkit allow to run mult iple DNS queries of your choice with a list of user-supplied re solvers. |
werkzeug | 3.0.1 | The comprehensive WSGI web application library. |
glances | v3.4.0. 2 |
Glances an Eye on your system. A top/htop alternative for GNU/ Linux, BSD, Mac OS and Windows operating systems. |
openrasp | v1.3.7 | 🔥Open source RASP solution |
stratus-red-team | v2.10.0 | ☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud |
jd | v1.7.1 | JSON diff and patch |
wesng | Windows Exploit Suggester - Next Generation | |
bandit | 1.7.5 | Bandit is a tool designed to find common security issues in Py thon code. |
ProcDump-for-Linu x |
2.2 | A Linux version of the ProcDump Sysinternals tool |
ioc | Threat Intel IoCs + bits and pieces of dark matter | |
apollo | v2.1.0 | Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. |
bat | v0.24.0 | A cat(1) clone with wings. |
trash-cli | Command line interface to the freedesktop.org trashcan. | |
psutil | Cross-platform lib for process and system monitoring in Python | |
croc | v9.6.6 | Easily and securely send things from one computer to another : crocodile: 📦 |
asnmap | v1.0.6 | Go CLI and Library for quickly mapping organization network ra nges using ASN information. |
FiraCode | 6.2 | Free monospaced font with programming ligatures |
list | The Public Suffix List | |
alive-progress | A new kind of Progress Bar, with real-time throughput, ETA, an d very cool animations! |
|
shellcheck | v0.9.0 | ShellCheck, a static analysis tool for shell scripts |
fyne | v2.4.1 | Cross platform GUI toolkit in Go inspired by Material Design |
filebrowser | v2.26.0 | 📂 Web File Browser |
Damn-Vulnerable-G raphQL-Application |
2.1.2 | Damn Vulnerable GraphQL Application is an intentionally vulner able implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security. |
git-lfs | v3.4.0 | Git extension for versioning large files |
openvpn-install | OpenVPN road warrior installer for Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora |
|
naxsi | 1.3 | NAXSI is an open-source, high performance, low rules maintenan ce WAF for NGINX |
oss-browser | v1.17.0 | OSS Browser 提供类似windows资源管理器功能。用户可以很方便的浏 览文件,上传下载文件,支持断点续传等。 |
LOLBAS | Living Off The Land Binaries And Scripts - (LOLBins and LOLScr ipts) |
|
fd | v8.7.1 | A simple, fast and user-friendly alternative to 'find' |
node-red | 3.1.0 | Low-code programming for event-driven applications |
soapui | v5.7.2 | SoapUI is a free and open source cross-platform functional tes ting solution for APIs and web services. |
ModSecurity | v3.0.10 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is develop ed by Trustwave's SpiderLabs. It has a robust event-bas |
sm-crypto | 国密算法js版 | |
pdfparser | v2.7.0 | PdfParser, a standalone PHP library, provides various tools to extract data from a PDF file. |
ILSpy | v8.2 | .NET Decompiler with support for PDB generation, ReadyToRun, M etadata (&more) - cross-platform! |
grafanaExp | V1.1 | A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability (CVE-2021-43798), it can burst plugins / extract secret_key / decrypt data_source info automatic. |
color | v1.5.4 | 🎨 Terminal color rendering library, support 8/16 colors, 256 colors, RGB color rendering output, support Print/Sprintf metho ds, compatible with Windows. GO CLI 控制台颜色渲染工具库,支持1 6色,256 |
csvtk | v0.28.0 | A cross-platform, efficient and practical CSV/TSV toolkit in G olang |
interactsh | v1.1.7 | An OOB interaction gathering server and client library |
fingerprintx | v1.1.11 | Standalone utility for service discovery on open ports! |
emp3r0r | v1.32.2 | Linux/Windows post-exploitation framework made by linux user |
color | v1.16.0 | Color package for Go (golang) |
merlin | v2.0.0 | Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang. |
spiderfoot | v4.0 | SpiderFoot automates OSINT for threat intelligence and mapping your attack surface. |
lsassy | v3.1.9 | Extract credentials from lsass remotely |
weird_proxies | Reverse proxies cheatsheet | |
Windows11_Hardeni ng |
a collection about Windows 11 | |
KaTeX | v0.16.9 | Fast math typesetting for the web. |
Rubeus | 1.6.4 | Trying to tame the three-headed dog. |
merlin-agent | v2.0.0 | Post-exploitation agent for Merlin |
telebot | v3.1.0 | Telebot is a Telegram bot framework in Go. |
gau | v2.2.1 | Fetch known URLs from AlienVault's Open Threat Exchange, the W ayback Machine, and Common Crawl. |
dnstwist | 2023091 8 |
Domain name permutation engine for detecting homograph phishin g attacks, typo squatting, and brand impersonation |
smbmap | v1.9.3. 1 |
SMBMap is a handy SMB enumeration tool |
linux-kernel-expl oitation |
A collection of links related to Linux kernel security and exp loitation |
|
ctf-wiki | Come and join us, we need you! | |
magic-wormhole | get things from one computer to another, safely | |
focalboard | v7.11.3 | Focalboard is an open source, self-hosted alternative to Trell o, Notion, and Asana. |
PetitPotam | PoC tool to coerce Windows hosts to authenticate to other mach ines via MS-EFSRPC EfsRpcOpenFileRaw or other functions. |
|
shuji | Reverse engineering JavaScript and CSS sources from sourcemaps | |
firmadyne | Platform for emulation and dynamic analysis of Linux-based fir mware |
|
scan4all | 2.8.7 | Official repository vuls Scan: 15000+PoCs; 23 kinds of applica tion password crack; 7000+Web fingerprints; 146 protocols and 9 0000+ rules Port scanning; Fuzz, HW, awesome BugBounty( |
retoolkit | 2023.10 | Reverse Engineer's Toolkit |
slopShell | the only php webshell you need. | |
SCFProxy | v0.2.1 | A proxy tool based on cloud function. |
al-khaser | Public malware techniques used in the wild: Virtual Machine, E mulation, Debuggers, Sandbox detection. |
|
aliyun-oss-python -sdk |
2.18.3 | Aliyun OSS SDK for Python |
Sentinel | 1.8.6 | A powerful flow control component enabling reliability, resili ence and monitoring for microservices. (面向云原生微服务的高可 用流控防护组件) |
fucking-algorithm | plugin | 刷算法全靠套路,认准 labuladong 就够了!English version suppor ted! Crack LeetCode, not only how, but also why. |
ICS-Security-Tool s |
Tools, tips, tricks, and more for exploring ICS Security. | |
Yara-rules | Collection of private Yara rules. | |
open-vm-tools | stable- 12.3.5 |
Official repository of VMware open-vm-tools project |
GmSSL | v3.1.1- pr1 |
支持国密SM2/SM3/SM4/SM9/SSL的密码工具箱 |
lazydocker | v0.23.1 | The lazier way to manage everything docker |
pacu | v1.4.2 | The AWS exploitation framework, designed for testing the secur ity of Amazon Web Services environments. |
scanning | ||
awesome-yara | A curated list of awesome YARA rules, tools, and people. | |
dontgo403 | 0.9.4 | Tool to bypass 40X response codes. |
showdoc | v3.2.2 | ShowDoc is a tool greatly applicable for an IT team to share d ocuments online一个非常适合IT团队的在线API文档、技术文档工具 |
docker_practice | v1.3.0 | Learn and understand Docker&Container technologies, with real DevOps practice! |
PrivescCheck | Privilege Escalation Enumeration Script for Windows | |
HijackLibs | Project for tracking publicly disclosed DLL Hijacking opportun ities. |
|
js-md5 | A simple MD5 hash function for JavaScript supports UTF-8 encod ing. |
|
server | v0.14.1 | Hashtopolis - A Hashcat wrapper for distributed password recov ery |
hackerone-reports | Top disclosed reports from HackerOne | |
FirmAE | v1.0 | Towards Large-Scale Emulation of IoT Firmware for Dynamic Anal ysis |
websocat | v1.12.0 | Command-line client for WebSockets, like netcat (or curl) for ws:// with advanced socat-like functions |
ja3 | JA3 is a standard for creating SSL client fingerprints in an e asy to produce and shareable way. |
|
uncover | v1.0.7 | Quickly discover exposed hosts on the internet using multiple search engines. |
S3Scanner | v3.0.4 | Scan for misconfigured S3 buckets across S3-compatible APIs! |
Nessus_Map | Parse .nessus file(s) and shows output in interactive UI | |
fail2ban | 1.0.2 | Daemon to ban hosts that cause multiple authentication errors |
SUDO_KILLER | A tool designed to exploit a privilege escalation vulnerabilit y in the sudo program on Unix-like systems. It takes advantage of a specific misconfiguration or flaw in sudo to gain |
|
rdpwrap | RDP Wrapper Library | |
source-code-pro | 2.042R- u/1.062R -i/1.026 R-vf |
Monospaced font family for user interface and coding environme nts |
cloudflair | 🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys. |
|
how-to-exit-vim | Below are some simple methods for exiting vim. | |
can-utils | v2023.0 3 |
Linux-CAN / SocketCAN user space applications |
Empire | v5.7.3 | Empire is a post-exploitation and adversary emulation framewor k that is used to aid Red Teams and Penetration Testers. |
Starkiller | v2.6.1 | Starkiller is a Frontend for PowerShell Empire. |
CaptfEncoder | 3.1.2 | Captfencoder is opensource a rapid cross platform network secu rity tool suite, providing network security related code conver sion, classical cryptography, cryptography, asymmetric |
ip2region | Ip2region (2.0 - xdb) is a offline IP address manager framewor k and locator, support billions of data segments, ten microseco nd searching performance. xdb engine implementation for |
|
Havoc | The Havoc Framework. | |
requests | v1.1.19 | 用于快速请求HTTP或HTTPS,并支持修改ja3指纹 |
singularity | A DNS rebinding attack framework. | |
gobuster | v3.6.0 | Directory/File, DNS and VHost busting tool written in Go |
pics | File formats explanations, logos redrawing... | |
cuc-ns | 网络安全课本 | |
danted | Fast script for installing & configing Danted--Socks5 Proxy Se rver. |
|
yari | YARI is an interactive debugger for YARA Language. | |
patator | Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage. |
|
libesedb | Library and tools to access the Extensible Storage Engine (ESE ) Database File (EDB) format. |
|
massdns | v1.0.0 | A high-performance DNS stub resolver for bulk lookups and reco nnaissance (subdomain enumeration) |
lynis | 3.0.9 | Lynis - Security auditing tool for Linux, macOS, and UNIX-base d systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation |
git-vuln-finder | v1.4 | Finding potential software vulnerabilities from git commit mes sages |
CMWTAT_Digital_Ed ition |
2.7.1.0 | CloudMoe Windows 10/11 Activation Toolkit get digital license, the best open source Win 10/11 activator in GitHub. GitHub 上 最棒的开源 Win10/Win11 数字权利(数字许可证)激活工具! |
supervisor | Supervisor process control system for Unix (supervisord) | |
HOUDINI | v0.2.9 | Hundreds of Offensive and Useful Docker Images for Network Int rusion. The name says it all. |
pypykatz | 0.6.9 | Mimikatz implementation in pure Python |
jdupes | v1.27.3 | A powerful duplicate file finder and an enhanced fork of 'fdup es'. |
HexRaysCodeXplore r |
2.1 | Hex-Rays Decompiler plugin for better code navigation |
nali | v0.8.0 | An offline tool for querying IP geographic information and CDN provider. 一个查询IP地理信息和CDN服务提供商的离线终端工具. |
PPLGuard | ||
webapp-wordlists | This repository contains wordlists for each versions of common web applications and content management systems (CMS). Each ve rsion contains a wordlist of all the files directories |
|
Beta | Beta versions of my software | |
dsq | v0.23.0 | Commandline tool for running SQL queries against JSON, CSV, Ex cel, Parquet, and more. |
forbidden | v10.2 | Bypass 4xx HTTP response status codes and more. Based on PycUR L and Python Requests. |
Thanks-Mirror | 整理记录各个包管理器,系统镜像,以及常用软件的好用镜像,Thanks Mirror。 走过路过,如觉不错,麻烦点个赞👆🌟 |
|
all-about-apikey | Detailed information about API key / OAuth token (Description, Request, Response, Regex, Example) |
|
bkcrack | v1.5.0 | Crack legacy zip encryption with Biham and Kocher's known plai ntext attack. |
bash-tutorial | Bash 教程 | |
can-i-take-over-x yz |
"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records. |
|
wait-for | v2.2.4 | ./wait-for is a script to wait for another service to become a vailable. |
trojan | v2.15.3 | trojan多用户管理部署程序, 支持web页面管理 |
gjson | Get JSON values quickly - JSON parser for Go | |
duf | v0.8.1 | Disk Usage/Free Utility - a better 'df' alternative |
GetMail | 利用NTLM Hash读取Exchange邮件 | |
Diamorphine | LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_6 4 and ARM64) |
|
RedGuard | 23.08.2 1 |
RedGuard is a C2 front flow control tool,Can avoid Blue Teams, AVs,EDRs check. |
webshell | v-2021- 01-05 |
This is a webshell open source project |
pingcastle | 3.1.0.1 | PingCastle - Get Active Directory Security at 80% in 20% of th e time |
curl-impersonate | v0.6.0- alpha.1 |
curl-impersonate: A special build of curl that can impersonate Chrome & Firefox |
Halfrost-Field | ✍🏻 这里是写博客的地方 —— Halfrost-Field 冰霜之地 | |
awesome-incident- response |
A curated list of tools for incident response | |
gophish | v0.12.1 | Open-Source Phishing Toolkit |
api-firewall | v0.6.13 | Fast and light-weight API proxy firewall for request and respo nse validation by OpenAPI specs. |
katana | v1.0.4 | A next-generation crawling and spidering framework. |
SavvyCAN | V213 | QT based cross platform canbus tool |
Administrative-di visions-of-China |
2.7.0 | 中华人民共和国行政区划:省级(省份)、 地级(城市)、 县级(区 县)、 乡级(乡镇街道)、 村级(村委会居委会) ,**省市区镇村 二级三级四级五级联动地址数据。 |
yongyou_nc_poc | ||
DVSA | a Damn Vulnerable Serverless Application | |
Responder | Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic |
|
WinPmem | v4.0.rc 1 |
The multi-platform memory acquisition tool. |
how-does-SecureCR T-encrypt-password |
Transferred from https://github.com/DoubleLabyrinth/how-does-S ecureCRT-encrypt-password |
|
shodan | v1.0.7 | yet another Shodan.io client |
nodejsscan | v4.8 | nodejsscan is a static security code scanner for Node.js appli cations. |
exa | v0.10.1 | A modern replacement for ‘ls’. |
Archive2 | 1.3.4 | |
iprange | v1.0.2 | 计算ip范围,支持 cidr,ip-range 格式的输入 |
awesome-adb | ADB Usage Complete / ADB 用法大全 | |
IIS-ShortName-Sca nner |
latest version of scanners for IIS short filename (8.3) disclo sure vulnerability |
|
CrackMapExec | v5.4.0 | A swiss army knife for pentesting networks |
sast-scan | v2.1.1 | Scan is a free & Open Source DevSecOps tool for performing sta tic analysis based security testing of your applications and it s dependencies. CI and Git friendly. |
JsRpc | v1.02 | 远程调用(rpc)浏览器方法,免去抠代码补环境 |
hindsight | v2023.0 3 |
Web browser forensics for Google Chrome/Chromium |
crc32 | v0.1 | CRC32 tools: reverse, undo/rewind, and calculate hashes |
fav-up | v0.2 | IP lookup by favicon using Shodan |
SigFlip | SigFlip is a tool for patching authenticode signed PE files (e xe, dll, sys ..etc) without invalidating or breaking the existi ng signature. |
|
spectre-meltdown- checker |
v0.46 | Downfall, Zenbleed, ZombieLoad, RIDL, Fallout, Foreshadow, Spe ctre, Meltdown vulnerability/mitigation checker for Linux & BSD |
KCon | KCon is a famous Hacker Con powered by Knownsec Team. | |
Tentacle | Tentacle is a POC vulnerability verification and exploit frame work. It supports free extension of exploits and uses POC scrip ts. It supports calls to zoomeye, fofa, shodan and othe |
|
dwarf2json | convert ELF/DWARF symbol and type information into vol3's inte rmediate JSON |
|
awesome-honeypots | an awesome list of honeypot resources | |
jaeles | beta-v0 .17.1 |
The Swiss Army knife for automated Web Application Testing |
btrace | v2.2.4 | BTrace - a safe, dynamic tracing tool for the Java platform |
Freeze | v1.3 | Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods |
poc | Proof of Concepts | |
one_gadget | v1.8.1 | The best tool for finding one gadget RCE in libc.so.6 |
tabby | v1.2.0- 3 |
A CAT called tabby ( Code Analysis Tool ) |
deepce | Docker Enumeration, Escalation of Privileges and Container Esc apes (DEEPCE) |
|
SecLists | 2023.2 | SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, c ollected in one place. List types include usernames, pa |
dirhunt | v0.9.0 | Find web directories without bruteforce |
proxify | v0.0.12 | A versatile and portable proxy for capturing, manipulating, an d replaying HTTP/HTTPS traffic on the go. |
RustScan | 2.1.1 | 🤖 The Modern Port Scanner 🤖 |
merlin | Cross-platform post-exploitation HTTP Command & Control agent written in golang |
|
tqdm | v4.66.1 | ⚡ A Fast, Extensible Progress Bar for Python and CLI |
teler | v2.0.0- dev.3 |
Real-time HTTP Intrusion Detection |
OpenRedireX | A fuzzer for detecting open redirect vulnerabilities | |
CrossC2 | v3.2 | generate CobaltStrike's cross-platform payload |
qiling | 1.4.6 | A True Instrumentable Binary Emulation Framework |
msdat | MSDAT: Microsoft SQL Database Attacking Tool | |
Windows-AD-enviro nment-related |
This Repository contains the stuff related to windows Active d irectory environment exploitation |
|
fierce | A DNS reconnaissance tool for locating non-contiguous IP space . |
|
awesome-vehicle-s ecurity |
🚗 A curated list of resources for learning about vehicle secu rity and car hacking. |
|
vlmcsd | svn1113 | KMS Emulator in C (currently runs on Linux including Android, FreeBSD, Solaris, Minix, Mac OS, iOS, Windows with or without C ygwin) |
BountyHunterInChi na |
重生之我是赏金猎人系列,分享自己和团队在SRC、项目实战漏洞测试 过程中的有趣案例 |
|
simplehttpserver | v0.0.6 | Go alternative of python SimpleHTTPServer |
bettercap | v2.32.0 | The Swiss Army knife for 802.11, BLE, IPv4 and IPv6 networks r econnaissance and MITM attacks. |
awesome-oscp | A curated list of awesome OSCP resources | |
sourcemapper | Extract JavaScript source trees from Sourcemap files | |
s3tk | A security toolkit for Amazon S3 | |
CVE-2020-1472 | Test tool for CVE-2020-1472 | |
mquery | v1.4.0 | YARA malware query accelerator (web frontend) |
knock | 5.4.0 | Knock Subdomain Scan |
zsteg | detect stegano-hidden data in PNG & BMP | |
PSGumshoe | v2.0 | |
PRET | Printer Exploitation Toolkit - The tool that made dumpster div ing obsolete. |
|
dive | v0.11.0 | A tool for exploring each layer in a docker image |
clairvoyance | v2.5.3 | Obtain GraphQL API schema even if the introspection is disable d |
Linux_LPE_eBPF_CV E-2021-3490 |
||
SIGRed_RCE_PoC | ||
MX1014 | v2.4.0 | MX1014 is a flexible, lightweight and fast port scanner. |
cloud-service-enu m |
||
cve-2020-0688 | cve-2020-0688 | |
stegoVeritas | Yet another Stego Tool | |
thc-ipv6 | v3.8 | IPv6 attack toolkit |
Penetration-Testi ng-Tools |
A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pen testing/IT Security audits purposes. |
|
wisper | A micro library providing Ruby objects with Publish-Subscribe capabilities |
|
PowerUpSQL | PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server | |
ctf-tools | Some setup scripts for security research tools. | |
wechat-backup | v1.0.0 | 微信聊天记录持久化备份本地硬盘,释放手机存储空间。 |
basecrack | v4.0 | Decode All Bases - Base Scheme Decoder |
Violation_Pnetest | 渗透红线Checklist | |
weevely3 | v4.0.1 | Weaponized web shell |
awesome-industria l-control-system-s ecurity |
A curated list of resources related to Industrial Control Syst em (ICS) security. |
|
windows_exploit_d owser |
A simple tool which could be useful to identify the exploits a fflicting a Windows OS |
|
jenv | 0.5.6 | Manage your Java environment |
etl2pcapng | v1.11.0 | Utility that converts an .etl file containing a Windows networ k packet capture into .pcapng format. |
CVE-2021-21972 | CVE-2021-21972 Exploit | |
kernel-exploit-fa ctory |
Linux kernel CVE exploit analysis report and relative debug en vironment. You don't need to compile Linux kernel and configure your environment anymore. |
|
Motrix | v1.8.19 | A full-featured download manager. |
java-sec-code | v2.0.0 | Java web common vulnerabilities and security code which is bas e on springboot and spring security |
DS_Store_crawler_ parser |
a parser + crawler for .DS_Store files exposed publically | |
wafw00f | v2.2.0 | WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website. |
shc | 4.0.3 | Shell script compiler |
safety | 2.3.5 | Safety checks Python dependencies for known security vulnerabi lities and suggests the proper remediations for vulnerabilities detected. |
hassh | HASSH is a network fingerprinting standard which can be used t o identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared |
|
ntlmv1-multi | NTLMv1 Multitool | |
poc-graphql | 1.0.0 | Research on GraphQL from an AppSec point of view. |
OffensiveNotion | v1.5.0 | Notion as a platform for offensive operations |
proxychains-ng | v4.16 | proxychains ng (new generation) - a preloader which hooks call s to sockets in dynamically linked programs and redirects it th rough one or more socks/http proxies. continuation of t |
dnsFookup | DNS rebinding toolkit | |
APIKit | v1.5.1 | APIKit:Discovery, Scan and Audit APIs Toolkit All In One. |
shadow-tls | v0.2.23 | A proxy to expose real tls handshake to the firewall |
javaboy-code-samp les |
公众号【江南一点雨】文章案例汇总,技术文章请戳这里-----> | |
espanso | v2.1.8 | Cross-platform Text Expander written in Rust |
chainoffools | A PoC for CVE-2020-0601 | |
xortool | A tool to analyze multi-byte xor cipher | |
theZoo | v0.60 | A repository of LIVE malwares for your own joy and pleasure. t heZoo is a project created to make the possibility of malware a nalysis open and available to the public. |
s3reverse | v1.0.1 | The format of various s3 buckets is convert in one format. for bugbounty and security testing. |
gitls | v1.0.4 | 🖇 Enumerate git repository URL from list of URL / User / Org. Friendly to pipeline |
the-craft-of-self teaching |
One has no future if one couldn't teach themself. | |
hello-world | ||
CVEs | The following is a list of my collected CVE's | |
ssti-payloads | 🎯 Server Side Template Injection Payloads | |
yaml-payload-for- ruoyi |
A memory shell for ruoyi | |
humre | A human-readable regular expression module for Python. | |
bypass-403 | A simple script just made for self use for bypassing 403 | |
jsrsasign | 10.8.5 | The 'jsrsasign' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA sign ing/validation, ASN.1, PKCS#1/5/8 private/public key, X |
cloudscraper | 1.2.68 | A Python module to bypass Cloudflare's anti-bot page. |
ccat | v1.01 | Cisco Config Analysis Tool |
KodExplorer | 4.51.03 | A web based file manager,web IDE / browser based code editor |
Pinyin2Hanzi | 拼音转汉字, 拼音输入法引擎, pin yin -> 拼音 | |
cheetah | a very fast brute force webshell password tool | |
Girsh | v0.41 | Automatically spawn a reverse shell fully interactive for Linu x or Windows victim |
htmlq | v0.4.0 | Like jq, but for HTML. |
sttr | v0.2.18 | cross-platform, cli app to perform various operations on strin g |
SeeYouCM-Thief | ||
Powershellery | This repo contains Powershell scripts used for general hackery . |
|
proxypool | v0.3.1 | Automatically crawls proxy nodes on the public internet, de-du plicates and tests for usability and then provides a list of no des |
Homework-of-Pytho n |
Python codes of my blog. | |
jo | 1.9 | JSON output from a shell |
top25-parameter | v1.0.7 | For basic researches, top 25 vulnerability parameters that can be used in automation tools or manual recon. 🛡️⚔️🧙 |
s3-buckets-finder | v1.2.0 | Find AWS S3 buckets and test their permissions. |
Realtek_switch_ha cking |
折腾交换机 | |
HostCollision | HostCol lision-2 .2.8 |
用于host碰撞而生的小工具,专门检测渗透中需要绑定hosts才能访问的 主机或内部系统 |
Azure-Red-Team | Azure Security Resources and Notes | |
autotimeliner | Automagically extract forensic timeline from volatile memory d ump |
|
APT_CyberCriminal _Campagin_Collecti ons |
APT & CyberCriminal Campaign Collection | |
nginx-ssl-ja3 | v0.0.2 | nginx module for SSL/TLS ja3 fingerprint. |
GraphQLmap | GraphQLmap is a scripting engine to interact with a graphql en dpoint for pentesting purposes. - Do not use for illegal testin g ;) |
|
donut | v1.0 | Generates x86, x64, or AMD64+x86 position-independent shellcod e that loads .NET Assemblies, PE files, and other Windows paylo ads from memory and runs them with parameters |
Red-Team-Infrastr ucture-Wiki |
Wiki to collect Red Team infrastructure hardening resources | |
pwn_jenkins | Notes about attacking Jenkins servers | |
byp4xx | 40X/HTTP bypasser in Go. Features: Verb tampering, headers, #b ugbountytips, User-Agents, extensions, default credentials... |
|
exrex | Irregular methods on regular expressions | |
CVE-2022-2588 | exploit for CVE-2022-2588 | |
javascript-malwar e-collection |
Collection of almost 40.000 javascript malware samples | |
alicloud-tools | v1.0.5 | 阿里云ECS、策略组辅助小工具 |
ebpfkit-monitor | ebpfkit-monitor is a tool that detects and protects against eB PF powered rootkits |
|
jsencrypt | A zero-dependency Javascript library to perform OpenSSL RSA En cryption, Decryption, and Key Generation. |
|
CVE-2020-0796-PoC | PoC for triggering buffer overflow via CVE-2020-0796 | |
bopscrk | v2.4.5 | Generate smart and powerful wordlists |
geckodriver | v0.33.0 | WebDriver for Firefox |
CVE-2018-10933 | Spawn to shell without any credentials by using CVE-2018-10933 (LibSSH) |
|
druid_sessions | 1.2 | 获取 alibaba druid 一些 sessions , sql , urls |
cloud-native-secu rity-book |
《云原生安全:攻防实践与体系构建》资料仓库 | |
onesixtyone | v0.3.4 | Fast SNMP Scanner |
WaterDragon | WaterDragon:用GithubAction实现代理功能。红队,cve,代理池,隐匿, 攻防,对抗,hackone,src,proxy,CVE-2020,CVE-2021,CVE-2022 |
|
SMx | 国家商用加密算法 SMx(SM2,SM3,SM4) | |
shhgit | Ah shhgit! Find secrets in your code. Secrets detection for yo ur GitHub, GitLab and Bitbucket repositories. |
|
apkleaks | v2.6.1 | Scanning APK file for URIs, endpoints & secrets. |
tsh-go | Tiny SHell Go - An open-source backdoor written in Go | |
github-search | v2.0.1 | A collection of tools to perform searches on GitHub. |
CobaltStrikeParse r |
||
antiHoneypot | 0.7.2 | 一个拦截 XSSI & 识别Web蜜罐的Chrome扩展 |
binwalk | v2.3.4 | Firmware Analysis Tool |
jira_scan | v0.0.6 | A simple remote scanner for Atlassian Jira |
OddProxyDemo | ||
anchore-engine | A service that analyzes docker images and scans for vulnerabil ities |
|
EVTX-ATTACK-SAMPL ES |
Windows Events Attack Samples | |
PHP_INCLUDE_TO_SH ELL_CHAR_DICT |
||
reverse-shell | Reverse Shell as a Service | |
fapro | v0.65 | Fake Protocol Server |
cs2modrewrite | Convert Cobalt Strike profiles to modrewrite scripts | |
pspy | v1.2.1 | Monitor linux processes without root permissions |
wenyan | v0.3.4 | 文言文編程語言 A programming language for the ancient Chinese. |
slipstream | NAT Slipstreaming allows an attacker to remotely access any TC P/UDP services bound to a victim machine, bypassing the victim ’s NAT/firewall, just by anyone on the victim's network |
|
TLS-poison | ||
flask-session-coo kie-manager |
v1.2.1. 1 |
🍪 Flask Session Cookie Decoder/Encoder |
security-bucket-b rigade |
||
hashcrack | Guesses hash types, picks some sensible dictionaries and rules for hashcat |
|
CVE-2021-27850_PO C |
A Proof of concept for CVE-2021-27850 affecting Apache Tapestr y and leading to unauthencticated remote code execution. |
|
exploits | ||
kerberoast | ||
fi6s | IPv6 network scanner designed to be fast | |
exploit-CVE-2017- 7494 |
SambaCry exploit and vulnerable container (CVE-2017-7494) | |
Arjun | 2.2.1 | HTTP parameter discovery suite. |
usbrply | Replay USB messages from Wireshark (.cap) files | |
javaweb-vuln | RASP测试靶场 | |
Pentest101 | 一些关于渗透测试的Tips | |
jasypt-spring-boo t |
jasypt- spring-b oot-pare nt-3.0.5 |
Jasypt integration for Spring boot |
CC-attack | v3.7.1 | Using Socks4/5 or http proxies to make a multithreading Http-f lood/Https-flood (cc) attack. |
marshalsec | ||
base58 | Base58 and Base58Check implementation compatible with what is used by the bitcoin network. |
|
LiME | v1.9.1 | LiME (formerly DMD) is a Loadable Kernel Module (LKM), which a llows the acquisition of volatile memory from Linux and Linux-b ased devices, such as those powered by Android. The too |
git-tips | ![]() |
|
CVE-2017-1000486 | Primefaces <= 5.2.21, 5.3.8 or 6.0 - Remote Code Execution Exp loit |
|
sec-dog | v1.0.4 | |
MSOLSpray | A password spraying tool for Microsoft Online accounts (Azure/ O365). The script logs if a user cred is valid, if MFA is enabl ed on the account, if a tenant doesn't exist, if a user |
|
TerraformGoat | 0.0.7 | TerraformGoat is HXSecurity research lab's "Vulnerable by Desi gn" multi cloud deployment tool. |
Chinese-Names-Cor pus |
v2.2 | 中文人名语料库。人名生成器。中文姓名,姓氏,名字,称呼,日本人名, 翻译人名,英文人名。可用于中文分词、人名实体识别。 |
toppwdhash | 常见密码哈希离线查询工具 , 包含算法类型'md5', 'md5x2', 'md5x3' ,'sha1', 'ntlm', 'mysql', 'mysql5','md5_sha1', 'sha1_sha1', 'sh a1_md5', 'md5_base64','md5_middle','base64_md5', 'md5_sha256', 'sha256',' |
|
UsnJrnl2Csv | v1.0.0. 24 |
Parser for $UsnJrnl on NTFS |
sliver-gui | v0.0.9 | A Sliver GUI Client |
HTTP-Smuggling-La b |
Use HTTP Smuggling Lab to learn HTTP Smuggling. | |
ProxyNotShell-PoC | ||
as_bypass_php_dis able_functions |
antsword bypass PHP disable_functions | |
wix3 | wix3112 rtm |
WiX Toolset v3.x |
exploitdb-bin-spl oits |
The legacy Exploit Database repository - New repo located at h ttps://gitlab.com/exploit-database/exploitdb-bin-sploits |
|
SSRF-Testing | SSRF (Server Side Request Forgery) testing resources | |
tools | Security and Hacking Tools, Exploits, Proof of Concepts, Shell codes, Scripts. |
|
csdroid | cs手机版的源码,此处不放源jar包,自行添加编译 | |
CVE-2022-3602 | ||
anti-portscan | 使用 iptables 防止端口扫描 | |
Extracted_WD_VDM | Windows Defender VDM lua collections | |
firmware-mod-kit | Automatically exported from code.google.com/p/firmware-mod-kit | |
siphon | v0.0.2 | ⚗️ Intercept stdin/stdout/stderr for any process |
NGLite | V1.0.01 | A major platform RAT Tool based by Blockchain/P2P.Now support Windows/Linux/MacOS |
katoolin | Automatically install all Kali linux tools | |
xerosploit | v1.0 | Efficient and advanced man in the middle framework |
ProxyVulns | [ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyOracle] CVE-2021-31195 & CVE-2021-31196 Exp loit Chains. [ProxyShell] CVE-2021-34473 & CVE-2021-345 |
|
Exchange2domain | CVE-2018-8581 | |
MailSniper | MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms ( passwords, insider intel, network architecture informat |
|
qqwry2mmdb | 2023041 9 |
为 Wireshark 能使用纯真网络 IP 数据库(QQwry)而提供的格式转换工 具 |
telegram-bot-api | v5.5.1 | Golang bindings for the Telegram Bot API |
SysmonEnte | ||
HandleKatz | PIC lsass dumper using cloned handles | |
Zoinks | Manage Engine Decrypter | |
jwtcat | A CPU-based JSON Web Token (JWT) cracker and - to some extent - scanner. |
|
IFaultrepElevated DataCollectionUAC |
||
Veil | 3.1.14 | Veil 3.1.X (Check version info in Veil at runtime) |
CVE-2022-40684 | A proof of concept exploit for CVE-2022-40684 affecting Fortin et FortiOS, FortiProxy, and FortiSwitchManager |
|
how-does-navicat- encrypt-password |
Transferred from https://github.com/DoubleLabyrinth/how-does-n avicat-encrypt-password |
|
bash-insulter | Insults the user when typing wrong command | |
Digital-Privacy | Information Protection & OSINT resources | |
CVE-2022-2992 | Authenticated Remote Command Execution in Gitlab via GitHub im port |
|
Pentest-Windows | Windows internals and exploitation tricks | |
mimipenguin | 2.0-rel ease |
A tool to dump the login password from the current linux user |
hackergame2021-wr iteups |
**科学技术大学第八届信息安全大赛的官方与非官方题解 | |
Socks5 | Socks5代理服务器搭建脚本/Socks5 shortcut creation script | |
poodle-PoC | 🐩 Poodle (Padding Oracle On Downgraded Legacy Encryptio n) attack CVE-2014-3566 🐩 |
|
monomorph | v1.0 | MD5-Monomorphic Shellcode Packer - all payloads have the same MD5 hash |
ipv6toolkit | SI6 Networks' IPv6 Toolkit | |
TaskSchedulerMisc | Misc TaskScheduler Plays | |
poc_and_exp | 搜集的或者自己写的poc或者exp | |
CVE-2022-39197-pa tch |
patch-0 .2 |
CVE-2022-39197 漏洞补丁. CVE-2022-39197 Vulnerability Patch. |
Security-PPT | Security-related Slide Presentation & Security Research Report (大安全各领域各公司各会议分享的PPT以及各类安全研究报告) |
|
network-fingerpri nt |
v0.0.1 | A fingerprint generation helper for nuclei network templates |
powerline-shell | A beautiful and useful prompt for your shell | |
gokart | v0.5.1 | A static analysis tool for securing Go code |
crlfuzz | v1.4.1 | A fast tool to scan CRLF vulnerability written in Go |
choose | v1.3.4 | A human-friendly and fast alternative to cut and (sometimes) a wk |
go-dork | v1.0.2 | The fastest dork scanner written in Go. |
CVE-2022-34918 | CVE-2022-34918 netfilter nf_tables 本地提权 POC | |
go-mimikatz | A wrapper around a pre-compiled version of the Mimikatz execut able for the purpose of anti-virus evasion. |
|
imcat | Show any image in a terminal window. | |
CVE-2022-36804 | A real exploit for BitBucket RCE CVE-2022-36804 | |
See-SURF | v2.0 | Python based scanner to find potential SSRF parameters |
CVE-2022-34918-LP E-PoC |
||
fireprox | AWS API Gateway management tool for creating on the fly HTTP p ass-through proxies for unique IP rotation |
|
iscsicpl_bypassUA C |
v1.0 | UAC bypass for x64 Windows 7 - 11(无弹窗版) |
package-manager-p roxy-settings |
记录各个包管理器代理设置坑点。 | |
taskcafe | 0.3.2 | An open source project management tool with Kanban boards |
Suborner | 1.0.1 | |
gmapsapiscanner | ||
LOG-HUB | 日志分析库,nuclei 的另一种用法 | |
Jira-Lens | v1.0.2 | Fast and customizable vulnerability scanner For JIRA written i n Python |
nps-auth-bypass | nps认证绕过利用工具,CVE-2022-40494,使用此工具可在浏览器访问w eb控制端后台页面,或者批量获取socks5和http代理 |
|
Invoke-x64dbg-loa ddll |
调用x64dbg中的loadll.exe白加黑示例代码 | |
Lsass-Shtinkering | ||
phantom-attack | POC for Phantom Attack | |
ini | v1.67.0 | Package ini provides INI file read and write functionality in Go |
WTSRM | WTSRM | |
Loki-bot | 多功能Windows机器运维管理工具 | |
ctop | v0.7.7 | Top-like interface for container metrics |
7z2hashcat | 1.9 | extract information from password-protected .7z archives (and .sfx files) such that you can crack these "hashes" with hashcat |
LinuxEelvation | Linux Eelvation(持续更新) | |
get_AV | Windows杀软在线对比辅助 | |
PPLdump | Dump the memory of a PPL with a userland exploit | |
DahuaConsole | Dahua Console, access internal debug console and/or other rese arched functions in Dahua devices. Feel free to contribute in t his project. |
|
unfurl | v0.4.3 | Pull out bits of URLs provided on stdin |
tomorrow-theme | Tomorrow Theme | |
jarm_randomizer | This tool was open sourced as part of JARM Randomizer: Evading JARM Fingerprinting for HiTB Amsterdam 2021. |
|
XORpass | Encoder to bypass WAF filters using XOR operations. | |
jira-mobile-ssrf- exploit |
Exploit code for Jira Mobile Rest Plugin SSRF (CVE-2022-26135) | |
csp_security_mist akes |
This repo has been replaced by https://www.cloudvulndb.org | |
KillDefender | A small (Edited) POC to make defender useless by removing its token privileges and lowering the token integrity |
|
writeups | ||
qsreplace | v0.0.3 | Accept URLs on stdin, replace all query string values with a u ser-supplied value |
DFSCoerce | ||
ExtractedDefender | ||
ADFSRelay | v1.0 | Proof of Concept Utilities Developed to Research NTLM Relaying Attacks Targeting ADFS |
PwnKit | Self-contained exploit for CVE-2021-4034 - Pkexec Local Privil ege Escalation |
|
APTSimulator | v0.9.4 | A toolset to make a system look as if it was the victim of an APT attack |
CTF_web | a project aim to collect CTF web practices . | |
blueming | 2022080 20633 |
备份文件扫描,并自动进行下载 |
cobalt-arsenal | My collection of battle-tested Aggressor Scripts for Cobalt St rike 4.0+ |
|
DirtyPipe-Android | 1.0.3 | Dirty Pipe root exploit for Android (Pixel 6) |
hikvision-decrypt er |
v1.0 | A simple cross platform program written in C++ used for decryp ting the configuration files created by Hikvision Security Came ras. Successor to my hikvision-xor-decrypter |
PostConfluence | v1.0 | 哥斯拉Confluence后渗透插件 MakeToken SearchPage ListAllUser Ad dAdminUser ListAllPage ........ |
face_recognition | v1.2.2 | The world's simplest facial recognition api for Python and the command line |
httprobe | v0.2 | Take a list of domains and probe for working HTTP and HTTPS se rvers |
test | ysoseri al-0.0.6 -SNAPSHO T |
just test |
client-side-proto type-pollution |
Prototype Pollution and useful Script Gadgets | |
fastjson-blacklis t |
||
dirble | v1.4.2 | Fast directory scanning and scraping tool |
PoC-CVE-2022-3019 0 |
POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina | |
knm | 鼠标键盘流量包取证 | |
spring-boot-start er-swagger |
2.0.2.R ELEASE |
自制spring boot starter for swagger 2.x,来试试吧,很好用哦~ |
msdt-follina | Codebase to generate an msdt-follina payload | |
CVE-2022-22972 | ||
CVE-2022-0540-RCE | Atlassian Jira Seraph Authentication Bypass RCE(CVE-2022-0540 ) |
|
CVE-2022-0185 | CVE-2022-0185 POC and Docker and Analysis write up | |
BlueLotus_XSSRece iver |
||
ModSecurity-nginx | v1.0.3 | ModSecurity v3 Nginx Connector |
fuzzdb | Automatically exported from code.google.com/p/fuzzdb | |
ip2domain | ip2doma in_v0.2 |
批量查询ip对应域名及百度权重、备案信息;ip反查域名;ip查备案信 息;资产归属查询;百度权重查询 |
SharPyShell | v1.3.0 | SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications |
CVE-2021-22555-Pi peVersion |
CVE-2021-22555 exploit rewritten with pipe primitive | |
WerTrigger | Weaponizing for privileged file writes bugs with windows probl em reporting |
|
Bug-Report | ||
swagger2markup | v1.3.4 | A Swagger to AsciiDoc or Markdown converter to simplify the ge neration of an up-to-date RESTful API documentation by combinin g documentation that’s been hand-written with auto-gene |
check-virtual-mac hine |
||
satellite | v0.0.4 | easy-to-use payload hosting |
AllatoriCrack | 7.6.2 | 破解 Java 混淆工具 Allatori |
BaoTa | 宝塔Linux面板 - 简单好用的服务器运维面板 | |
zscan | v2.0.1 | Zscan a scan blasting tool set |
sec-interview | 信息安全面试题汇总 | |
gron | v0.7.1 | Make JSON greppable! |
rules | Repository of yara rules | |
CobaltNotion | A spin-off research project. Cobalt Strike x Notion collab 202 2 |
|
aliyun-accesskey- Tools |
v1.3 | 阿里云accesskey利用工具 |
zipcreater | v0.0.2 | ZipCreater主要应用于跨目录的文件上传漏洞的利用,它能够快速进行 压缩包生成。 |
Spring4Shell-POC | Dockerized Spring4Shell (CVE-2022-22965) PoC application and e xploit |
|
waybackurls | v0.1.0 | Fetch all the URLs that the Wayback Machine knows about for a domain |
CVE-2022-25636-Pi peVersion |
CVE-2022-25636 exploit rewritten with pipe primitive | |
CVE-2022-0185-Pip eVersion |
CVE-2022-0185 exploit rewritten with pipe primitive | |
SpringShell | Spring4Shell - Spring Core RCE - CVE-2022-22965 | |
VindicateTool | LLMNR/NBNS/mDNS Spoofing Detection Toolkit | |
Spring4Shell-POC | This is a dockerized application that is vulnerable to the Spr ing4Shell vulnerability (CVE-2022-22965). |
|
pydictor | v2.0.5 | A powerful and useful hacker dictionary builder for a brute-fo rce attack |
kernel-exploits | My proof-of-concept exploits for the Linux kernel | |
hetty | v0.7.0 | An HTTP toolkit for security research. |
AttackDetection | Attack Detection | |
CVE-2022-0778 | Proof of concept for CVE-2022-0778, which triggers an infinite loop in parsing X.509 certificates due to a bug in BN_mod_sqrt |
|
writeups | ||
CVE-2022-27666 | Exploit for CVE-2022-27666 | |
rsatool | rsatool can be used to calculate RSA and RSA-CRT parameters | |
vulnerability-lis t |
在渗透测试中快速检测常见中间件、组件的高危漏洞。 | |
XSStrike | 3.1.5 | Most advanced XSS scanner. |
GBByPass | 冰蝎 哥斯拉 WebShell bypass | |
anew | v0.1.1 | A tool for adding new lines to files, skipping duplicates |
Karta | v2.1.0 | Karta - source code assisted fast binary matching plugin for I DA |
dompdf-rce | RCE exploit for dompdf | |
big_screen | 数据大屏可视化 | |
vcenter_saml_logi n |
A tool to extract the IdP cert from vCenter backups and log in as Administrator |
|
Markdown-XSS-Payl oads |
XSS payloads for exploiting Markdown syntax | |
CVE-2022-0847-Dir tyPipe-Exploit |
A root exploit for CVE-2022-0847 (Dirty Pipe) | |
AWSBucketDump | Security Tool to Look For Interesting Files in S3 Buckets | |
CVE-2022-25636 | CVE-2022-25636 | |
3vilGu4rd | 3vilGu4 rd-V0.2 |
This is a daemon process which make a programe runing all time . |
Spring-Cloud-Gate way-CVE-2022-22947 |
CVE-2022-22947 | |
cidr-merger | v1.1.3 | A simple command line tool to merge ip/ip cidr/ip range, suppo rts IPv4/IPv6 |
proxylogscan | v0.0.2 | A fast tool to mass scan for a vulnerability on Microsoft Exch ange Server that allows an attacker bypassing the authenticatio n and impersonating as the admin (CVE-2021-26855). |
MQTT-Explorer | v0.3.5 | An all-round MQTT client that provides a structured topic over view |
cve-2022-23131 | cve-2022-23131 zabbix-saml-bypass-exp | |
jQuery-with-XSS | jQuery with XSS, Testing and Secure Version | |
CNVD-2022-10270-L PE |
2022-02 -24 |
基于向日葵RCE的本地权限提升,无需指定端口 |
mitm6 | v0.3.0 | pwning IPv4 via IPv6 |
WindowsElevation | Windows Elevation(持续更新) | |
sunlogin_rce | new | 向日葵 RCE |
Sylas | beta | 数据库综合利用工具 |
My-Shodan-Scripts | Collection of Scripts for shodan searching stuff. | |
KillDefender | A small POC to make defender useless by removing its token pri vileges and lowering the token integrity |
|
403-fuzz | 针对 403 页面的 fuzz 脚本 | |
CollaboratorPlusP lus |
v1.0.2 | |
ripple20 | A Zeek package for the passive detection of "Ripple20" vulnera bilities in the Treck TCP/IP stack. |
|
CVE-2019-11539 | Exploit for the Post-Auth RCE vulnerability in Pulse Secure Co nnect |
|
patching | v0.1.2 | An Interactive Binary Patching Plugin for IDA Pro |
CVE-2021-4034-NoG CC |
v4.0 | CVE-2021-4034简单优化,以应对没有安装gcc和make的目标环境 |
BeRoot | 1.0.1 | Privilege Escalation Project - Windows / Linux / Mac |
Cloud-Pentesting | This repository is in progress, it will keep updating as I com e across to new learning materials. Feel free to contribute. |
|
trevorc2 | TrevorC2 is a legitimate website (browsable) that tunnels clie nt/server communications for covert command execution. |
|
netview | latest | Netview enumerates systems using WinAPI calls |
CVE-2021-4034 | CVE-2021-4034 1day | |
CVE-2021-4034 | polkit pkexec Local Privilege Vulnerability to Add custom comm ands |
|
CVE-2022-21882 | win32k LPE | |
ja3box | extract ja3(s) when sniffing or from a pcap. | |
CVE-2021-4034 | PoC for PwnKit: Local Privilege Escalation Vulnerability in po lkit’s pkexec (CVE-2021-4034) |
|
Libra | Libra [ 天秤座 ] | |
social-engineer-t oolkit |
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here. |
|
SuperMem | A python script developed to process Windows memory images bas ed on triage type. |
|
exploits | Pwn stuff. | |
JSP-Webshells | Collect JSP webshell of various implementation methods. 收集JS P Webshell的各种姿势 |
|
CVE-2021-22205 | GitLab CE/EE Preauth RCE using ExifTool | |
CVE-2021-21985_Po C |
||
ShadowSteal | Pure Nim implementation for exploiting CVE-2021-36934, the Ser iousSAM local privilege escalation |
|
gmsm | v1.4.1 | GM SM2/3/4 library based on Golang (基于Go语言的国密SM2/SM3/SM 4算法库) |
SMTP-NC | v0.1.1 | SMTP Netcat , test SMTP protocol |
domain_screen | 站点批量截图 | |
go-shodan | v2.0.4 | Shodan API client |
linux-exploit-sug gester-2 |
Next-Generation Linux Kernel Exploit Suggester | |
MyTools | ||
Blind-SSRF | Nuclei Templates to reproduce Cracking the lens's Research | |
shiftleft-go-demo | ||
CVE-2019-5736-PoC | PoC for CVE-2019-5736 | |
Spring-Boot-Vulne rability |
||
blind-ssrf-chains | An exhaustive list of all the possible ways you can chain your Blind SSRF vulnerability |
|
ShadowCoerce | MS-FSRVP coercion abuse PoC | |
SimpleDnsCrypt | 0.7.1 | A simple management tool for dnscrypt-proxy |
rdesktop | v1.9.0 | 🚨 rdesktop is in need of a new maintainter. Please see the ho me page for more details. 🚨 |
ZhouYu | (周瑜)Java - SpringBoot 持久化 WebShell 学习demo(不仅仅是Sp ringBoot,适合任何符合JavaEE规范的服务) |
|
-Baseline-check | windows和linux基线检查,配套自动化检查脚本。纯手打。 | |
Tencent_Yun_tools | ||
CVE-2020-0683 | CVE-2020-0683 - Windows MSI “Installer service” Elevation of Privilege |
|
cve-2021-22005-ex p |
||
Logout4Shell | Use Log4Shell vulnerability to vaccinate a victim server again st Log4Shell |
|
Duckyspark | Translator from USB-Rubber-Ducky payloads to a Digispark code. | |
SIET | Smart Install Exploitation Tool | |
distorm | 3.5.2b | Powerful Disassembler Library For x86/AMD64 |
shakeitoff | AKB-Rel ease |
Windows MSI Installer LPE (CVE-2021-43883) |
learn-java-bug | ||
4-ZERO-3 | 403/401 Bypass Methods + Bash Automation + Your Support ;) | |
kekeo | 2.2.0-2 0211214 |
A little toolbox to play with Microsoft Kerberos in C |
noPac | CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter. | |
Log4jAttackSurfac e |
||
neofetch | 7.1.0 | 🖼️ A command-line system information tool written in bash 3. 2+ |
FourEye | 1.8 | AV Evasion Tool For Red Team Ops |
SSRFire | An automated SSRF finder. Just give the domain name and your s erver and chill! ;) Also has options to find XSS and open redir ects |
|
gobfuscate | Obfuscate Go binaries and packages | |
subjs | v1.0.1 | Fetches javascript file from a list of URLS or subdomains. |
lolcat | Rainbows and unicorns! | |
StandIn | v1.3 | StandIn is a small .NET35/45 AD post-exploitation toolkit |
VMware_vCenter | VMware vCenter 7.0.2.00100 unauth Arbitrary File Read + SSRF + Reflected XSS |
|
3gstudent | ||
CVE-2021-42321 | Microsoft Exchange Server Poc | |
k8s-CVE-2021-4355 7-poc |
PoC for CVE-2021-43557 | |
CVE-2021-41277 | Metabase任意文件读取漏洞批量扫描工具 | |
aem-hacker | ||
Corsy | 1.0-rc | CORS Misconfiguration Scanner |
YarnRpcRCE | 0.0.1 | |
bitcracker | BitCracker is the first open source password cracking tool for memory units encrypted with BitLocker |
|
CVE-2021-37580 | CVE-2021-37580 | |
SharpMapExec | ||
fmem | Linux Kernel Module designed to help analyze volatile memory i n the linux kernel |
|
F5-steganography | F5 steganography | |
tyton | v1.2 | Kernel-Mode Rootkit Hunter |
JavaCodeAudit | Getting started with java code auditing 代码审计入门的小项目 | |
SharpSphere | 2.1 | .NET Project for Attacking vCenter |
crawlergo_x_XRAY | 360/0Kee-Team/crawlergo动态爬虫结合长亭XRAY扫描器的被动扫描功 能 |
|
pafish | v0.6 | Pafish is a testing tool that uses different techniques to det ect virtual machines and malware analysis environments in the s ame way that malware families do |
geye | 1.2.0 | 🚀Faster Github Monitor🚀 |
aSiagaming | My Chrome and Safari exploit code + write-up repo | |
CVE-2021-36260-me tasploit |
the metasploit script(POC) about CVE-2021-36260 | |
HikPwn | HikPwn, a simple scanner for Hikvision devices with basic vuln erability scanning capabilities written in Python 3.8. |
|
Gitlab-CVE-2021-2 2205 |
||
BruteShark | v1.2.5 | Network Analysis Tool |
pkcrack | pkcrack with modern building tools | |
CVE-2020-9484 | ||
avList | avList - 杀软进程对应杀软名称 | |
impacket-ghostpot ato |
impacket-ghostpotato Fork from https://shenaniganslabs.io/2019 /11/12/Ghost-Potato.html |
|
nosferatu | Windows NTLM Authentication Backdoor | |
Finger | A tool for recognizing function symbol | |
CVE-2020-5902 | CVE-2020-5902 BIG-IP | |
jarm | ||
Exchange_SSRF | Some Attacks of Exchange SSRF ProxyLogon&ProxyShell | |
PortBrute | 一款跨平台小巧的端口爆破工具,支持爆破FTP/SSH/SMB/MSSQL/MYSQL/ POSTGRESQL/MONGOD / A cross-platform compact port blasting tool that supports blasting FTP/SSH/SMB/MSSQL/MYSQL/POSTGRESQL/MONG OD |
|
NetLoader | Loads any C# binary in mem, patching AMSI + ETW. | |
KMS_VL_ALL | 44 | 🔑KMS_VL_ALL - Smart Activation Script |
NetUser | 2.0 | 使用windows api添加用户,可用于net无法使用时.分为nim版,c++版 本,RDI版,BOF版。 |
CVE-2021-22005 | ||
henggeFish | 自动化批量发送钓鱼邮件(横戈安全团队出品) | |
CVE-2021-3493 | Ubuntu OverlayFS Local Privesc | |
coremail-address- book |
0.0.2 | 📧Coremail邮件系统组织通讯录导出脚本 |
JavaScript-MD5 | JavaScript MD5 implementation. Compatible with server-side env ironments like node.js, module loaders like RequireJS and all w eb browsers. |
|
wmi | 1.1.0 | WMI for Go |
evilzip | 1.1 | evilzip lets you create a zip file(with password) that contain s files with directory traversal characters in their embedded p ath. |
PrintNightmare | ||
Tools | GitHub repository for sysadmin related tools | |
CVE-2021-40444 | CVE-2021-40444 PoC | |
altdns | Generates permutations, alterations and mutations of subdomain s and then resolves them |
|
CS_mock | 模拟cobalt strike beacon上线包. Simulation cobalt strike beaco n connection packet. |
|
htpwdScan | HTTP weak pass scanner | |
BeaconEye | Hunts out CobaltStrike beacons and logs operator command outpu t |
|
outguess | 0.4 | Universal steganographic tool |
pupy | Pupy is an opensource, cross-platform (Windows, Linux, OSX, An droid) C2 and post-exploitation framework written in python and C |
|
CVE-2021-1675_RDL _LPE |
PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内 存加载、混淆加载的驱动名称来ByPass Defender/EDR。 |
|
CVE-2021-26084_Po C |
||
sensinfor | 1.6 | A chrome extension use to find leak file and backup file. |
coremail-exp | ||
tongda-exp | 1.0.1 | python编写的多个通达常见漏洞exp |
proxyshell-for-ex change_workload |
||
CORS_vulnerable_L ab-Without_Databas e |
||
cve-2021-3449 | CVE-2021-3449 OpenSSL denial-of-service exploit 👨🏻💻 | |
31-days-of-API-Se curity-Tips |
This challenge is Inon Shkedy's 31 days API Security Tips. | |
jobber | v1.4.4 | An alternative to cron, with sophisticated status-reporting an d error-handling |
Invoke-BuildAnony mousSMBServer |
Use to build an anonymous SMB file server. | |
textfilter | 敏感词过滤的几种实现+某1w词敏感词库 | |
proxyshell-poc | ||
RGPerson | RGPerson - Randomly generate identity information | |
PadBuster | Automated script for performing Padding Oracle attacks | |
redis-rogue-serve r-win |
Redis 4.x & 5.x RCE | |
vulnerability | ||
proxyshell_payloa d |
proxyshell payload generate | |
ProxyShell | ProxyShell POC Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write) |
|
ADCSPwn | ADCSPwn | A tool to escalate privileges in an active directory network b y coercing authenticate from machine accounts and relaying to t he certificate service. |
experiments | Expriments | |
CS-Loader | CS免杀 | |
OSCP_note | ||
CVE-Exploits | PoC exploits for software vulnerabilities | |
xcdn | Try to find out the real ip behind cdn | |
PySharpSphere | Yet another SharpSphere | |
IOCs-IDPS | This repository will hold PCAP IOC data related with known mal ware samples (owner: Bryant Smith) |
|
SecurityBaselineC heck |
||
surferFTP | SSRF to TCP Port Scanning, Banner and Private IP Disclosure by abusing the FTP protocol/clients |
|
HiveNightmare | 0.6 | Exploit allowing you to read registry hives as non-admin on Wi ndows 10 and 11 |
CobaltStrikeDetec ted |
40行代码检测到大部分CobaltStrike的shellcode | |
CVE-2021-3156 | Sudo Baron Samedit Exploit | |
CVE-2021-33909 | Sequoia exploit (7/20/21) | |
TongdaOA-exp | TongdaOA 11.7 ~11.8 通达OA,任意用户登录+后台getshell | |
cve-2021-34558 | ||
CVE-2018-3245 | CVE-2018-3245-PoC | |
CVE-2021-21974 | POC for CVE-2021-21974 VMWare ESXi RCE Exploit | |
CVE-2021-1675 | C# and Impacket implementation of PrintNightmare CVE-2021-1675 /CVE-2021-34527 |
|
CVE-2020-11651 | CVE-2020-11651: Proof of Concept | |
speedtest-cli | v2.1.3 | Command line interface for testing internet bandwidth using sp eedtest.net |
CVE-2021-1675-LPE | Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021- 34527 |
|
xxl-job | 1.0 | xxl-job RESTful API RCE |
Limelighter | A tool for generating fake code signing certificates or signin g real ones |
|
chacal | Golang anti-vm framework for Red Team and Pentesters | |
yaml-payload-for- Win |
用于windows反弹shell的yaml-payload | |
ssh-auditor | v0.18 | The best way to scan for weak ssh passwords on your network |
Catch-Browser | This is a crawler password tool | |
emby_ssrf | ||
windows-kernel-ex ploits |
windows-kernel-exploits Windows平台提权漏洞集合 | |
fuzzdb | v0.3 | Dictionary of attack patterns and primitives for black-box app lication fault injection and resource discovery. |
Teemo | A Domain Name & Email Address Collection Tool | |
luaforwindows | v5.1.5- 52 |
Lua for Windows is a 'batteries included environment' for the Lua scripting language on Windows. NOTICE: Looking for maintain er. |
corsair_scan | v0.2.0 | Corsair_scan is a security tool to test Cross-Origin Resource Sharing (CORS). |
cronsun | v0.3.5 | A Distributed, Fault-Tolerant Cron-Style Job System. |
blog-hugo | 基于Hugo的静态博客 | |
CVE-2021-31166 | v1 | Proof of concept for CVE-2021-31166, a remote HTTP.sys use-aft er-free triggered remotely. |
OscpStudyGroup | Oscp study group | |
nmap-bootstrap-xs l |
A Nmap XSL implementation with Bootstrap. | |
AntSword-Labs | Awesome environment for antsword tests | |
iconhash | v0.4.3 | fofa shodan favicon.ico hash icon ico 计算器 |
TLS-poison | ||
CTF-Mind-maps | 整合入门到中高级题目的思路,for new CTFers ! | |
endlessh | 1.0 | SSH tarpit that slowly sends an endless banner |
smuggler | Smuggler - An HTTP Request Smuggling / Desync testing tool wri tten in Python 3 |
|
cuckoo | 2.0.6 | Cuckoo Sandbox is an automated dynamic malware analysis system |
RCE-Exploit-in-BI G-IP |
||
payloads | Git All the Payloads! A collection of web attack payloads. | |
morty | Privacy aware web content sanitizer proxy as a service | |
SimpleShellcodeIn jector |
SimpleShellcodeInjector receives as an argument a shellcode in hex and executes it. It DOES NOT inject the shellcode in a thi rd party application. |
|
big-list-of-naugh ty-strings |
The Big List of Naughty Strings is a list of strings which hav e a high probability of causing issues when used as user-input data. |
|
msbuild-inline-ta sk |
||
List-RDP-Connecti ons-History |
Use powershell to list the RDP Connections History of logged-i n users or all users |
|
Eventlogedit-evt- -General |
Remove individual lines from Windows Event Viewer Log (EVT) fi les |
|
From-System-autho rity-to-Medium-aut hority |
Penetration test | |
Eventlogedit-evtx --Evolution |
v1.1.0 | Remove individual lines from Windows XML Event Log (EVTX) file s |
CVE-2021-24086 | Proof of concept for CVE-2021-24086, a NULL dereference in tcp ip.sys triggered remotely. |
|
RedGhost | Linux post exploitation framework written in bash designed to assist red teams in persistence, reconnaissance, privilege esca lation and leaving no trace. |
|
CoreMailUploadRce | Coremail任意文件上传漏洞POC | |
Syborg | Recursive DNS Subdomain Enumerator with dead-end avoidance sys tem (BETA) |
|
x-crack | 1.0.1 | x-crack - Weak password scanner, Support: FTP/SSH/SNMP/MSSQL/M YSQL/PostGreSQL/REDIS/ElasticSearch/MONGODB |
suricata-rules | Suricata IDS rules 用来检测红队渗透/恶意行为等,支持检测Cobalt Strike/MSF/Empire/DNS隧道/Weevely/菜刀/冰蝎/挖矿/反弹shell/ICMP 隧道等 |
|
REALITY_SMASHER | vRealize RCE + Privesc (CVE-2021-21975, CVE-2021-21983, CVE-0D AY-?????) |
|
CVE-2021-22986 | CVE-2021-22986 & F5 BIG-IP RCE | |
geacon | 修改自geacon的多功能linux运维管理工具 | |
SharpProxyLogon | C# POC for CVE-2021-26855 aka ProxyLogon, supports the classic ally semi-interactive web shell as well as shellcode injection |
|
Python-dsstore | A library for parsing .DS_Store files and extracting file name s |
|
Evaluation_tools | 测评工具 | |
sasquatch | ||
hey | v0.1.4 | HTTP load generator, ApacheBench (ab) replacement |
Luyten | v0.5.4_ Rebuilt_ with_Lat est_depe nencies |
An Open Source Java Decompiler Gui for Procyon |
ProxyLogon | ||
ProxyLogon | ProxyLogon(CVE-2021-26855+CVE-2021-27065) Exchange Server RCE( SSRF->GetWebShell) |
|
security-research -pocs |
Proof-of-concept codes created as part of security research do ne by Google Security Team. |
|
Proxylogon-exploi t |
proxylogon exploit - CVE-2021-26857 | |
CVE-2017-7494 | Remote root exploit for the SAMBA CVE-2017-7494 vulnerability | |
CVE-2021-21972 | CVE-2021-21972 Unauthorized RCE in VMware vCenter metasploit e xploit script |
|
Vulmap | Vulmap Online Local Vulnerability Scanners Project | |
CVE-2021-1732-Exp loit |
CVE-2021-1732 Exploit | |
Malbox | 恶意软件容器靶机 | |
CVE-2021-23132 | com_media allowed paths that are not intended for image upload s to RCE |
|
DotNetToJScriptMi ni |
A simplified version of DotNetToJScript to create a JScript fi le which loads a .NET v2 assembly from memory. |
|
exploits | Some of my exploits. | |
CVE-2021-21972 | Proof of Concept Exploit for vCenter CVE-2021-21972 | |
CANToolz | v3.7.0 | CANToolz - Black-box CAN network analysis framework |
Inspur | Inspur vul repo | |
WebAliveScan | 对目标域名进行快速的存活扫描、简单的指纹识别、目录扫描 | |
linuxprivchecker | linuxprivchecker.py -- a Linux Privilege Escalation Check Scri pt |
|
awesome-iocs | A collection of sources of indicators of compromise. | |
ruler | 2.4.1 | A tool to abuse Exchange services |
SpringBootLearnin g |
Spring Boot learning process | |
Mod_Rewrite_Autom ation |
Scripts to automate standing up apache2 with mod_rewrite in fr ont of C2 servers. |
|
CVE-2021-3156-plu s |
CVE-2021-3156非交互式执行命令 | |
Jumpserver-EXP | JumpServer远程代码执行漏洞检测利用脚本 | |
CVE-2021-3156 | PoC for CVE-2021-3156 (sudo heap overflow) | |
wrk | Modern HTTP benchmarking tool | |
docker-oracle-xe- 11g |
Dockerfile of Oracle Database Express Edition 11g Release 2 | |
CVE-2019-1040 | CVE-2019-1040 with Exchange | |
CVE-2021-3156 | ||
CVE-2021-3156 | CVE-2021-3156 | |
laravel-exploits | Exploit for CVE-2021-3129 | |
ListRDPConnection s |
0.0.3 | C# 读取本机对外RDP连接记录和其他主机对该主机的连接记录,从而在 内网渗透中获取更多可通内网网段信息以及定位运维管理人员主机 |
webuploader | 0.1.5 | It's a new file uploader solution! |
BT_Panel_Privileg e_Escalation |
宝塔面板Windows版提权方法 | |
suricata-rules | Suricata rules for the new critical vulnerabilities | |
AheadLib-x86-x64 | 1.2 | hijack dll Source Code Generator. support x86/x64 |
EgGateWayGetShell _py |
EgGateWayGetShell py脚本 | |
skyscorpion | 1.0.rel ease.202 10322 |
新版将不再对外公开发布。天蝎权限管理工具采用Java平台的JavaFX技 术开发的桌面客户端,支持跨平台运行,目前基于JDK1.8开发,运行必须 安装JDK或JRE 1.8,注意不能是open jdk,只能是oracle的jdk。 天蝎权 限管理工具基于冰蝎加密流量进行WebShell通信管理的原理,目前实现了 jsp、aspx、php、asp端的常用操作功能,在原 |
passToJs | 爆破js加密的后台登陆;JS加密;爆破密码;PyExecJS | |
SAP_EEM_CVE-2020- 6207 |
PoC for CVE-2020-6207 (Missing Authentication Check in SAP Sol ution Manager) |
|
bugbounty-cheatsh eet |
A list of interesting payloads, tips and tricks for bug bounty hunters. |
|
LuWu | 红队基础设施自动化部署工具 | |
CVE-2020-36179 | CVE-2020-36179~82 Jackson-databind SSRF&RCE | |
SharpRDPLog | 0.1 | Windows rdp相关的登录记录导出工具,可用于后渗透中Windows服务器 的信息收集阶段。输出内容包括:本地rdp端口、mstsc缓存、cmdkey缓存 、登录成功、失败日志事件。 |
Drupalgeddon2 | Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600 / SA-CORE-2018-002) |
|
CVE-2020-17518 | ||
windows_protocol | ||
fuxploider | v1.0 | File upload vulnerability scanner and exploitation tool. |
dcpwn | an impacket-dependent script exploiting CVE-2019-1040 | |
CVE-2020-35728 | CVE-2020-35728 & Jackson-databind RCE | |
CVE-2020-6308-PoC | PoC CVE-2020-6308 | |
open-source-badge s |
![]() |
|
CVE-2020-17144-EX P |
Exchange2010 authorized RCE | |
LsassSilentProces sExit |
Command line interface to dump LSASS memory to disk via Silent ProcessExit |
|
UnblockNeteaseMus ic |
v0.25.3 | Revive unavailable songs for Netease Cloud Music |
xpinyin | Translate Chinese hanzi to pinyin (拼音) by Python, 汉字转拼音 | |
AngelSword | Python3编写的CMS漏洞检测框架 | |
MobaXterm-Decrypt or |
MobaXterm Decryptor | |
web-cve-tests | A simple framework for sending test payloads for known web CVE s. |
|
rsdl | Subdomain Scan With Ping Method. | |
volatility | An advanced memory forensics framework | |
CVE-2020-17144 | weaponized tool for CVE-2020-17144 | |
dnSpy | v6.1.8 | .NET debugger and assembly editor |
Kali-TX | Customized Kali Linux - Ansible playbook | |
kalitools | Kali Linux工具清单 | |
ActuatorExploit | SpringBoot Actuator未授权自动化利用,支持信息泄漏/RCE | |
web-log-parser | An open source analysis web log tool | |
Apache-NiFi-Api-R CE |
||
wfuzz | v3.1.0 | Web application fuzzer |
peerflix | Streaming torrent client for node.js | |
HackMySQL | Using To MySQL Elevate Privileges. | |
CVE-2020-14882 | CVE-2020–14882、CVE-2020–14883 | |
webshell-detect-b ypass |
绕过专业工具检测的Webshell研究文章和免杀的Webshell | |
hackergame2018-wr iteups |
Write-ups for hackergame 2018 | |
Malleable-C2-Prof iles |
Malleable C2 is a domain specific language to redefine indicat ors in Beacon's communication. This repository is a collection of Malleable C2 profiles that you may use. These profil |
|
subjack | 2.1 | Subdomain Takeover tool written in Go |
CVE-2020-1472 | Exploit Code for CVE-2020-1472 aka Zerologon | |
bigdata_practice | 大数据分析可视化实践 | |
beanstack | v0.6.1 | X41 BeanStack - Stack Trace Fingerprinting BETA |
CVE-2020-13935 | Exploit for WebSocket Vulnerability in Apache Tomcat | |
XxlJob-Hessian-RC E |
XxlJob<=2.1.2配置不当情况下反序列化RCE | |
java-file-ftp | POC for leaking java version through file and ftp protocols | |
ja3transport | Impersonating JA3 signatures | |
Impulse | 💣 Impulse Denial-of-service ToolKit | |
SharpChromium | .NET 4.0 CLR Project to retrieve Chromium data, such as cookie s, history and saved logins. |
|
js-port-knocking | Web 端口敲门的奇思妙想 | |
pure-bash-bible | 📖 A collection of pure bash alternatives to external processe s. |
|
rekall | v1.7.1 | Rekall Memory Forensic Framework |
tlslite-ng | New home of the TLS implementation in pure python | |
springfox | 3.0.0 | Automated JSON API documentation for API's built with Spring |
HERCULES | HERCULES is a special payload generator that can bypass antivi rus softwares. |
|
Quickdraw-Snort | Digital Bond's IDS/IPS rules for ICS and ICS protocols. | |
geacon | Practice Go programming and implement CobaltStrike's Beacon in Go |
|
SAP_RECON | PoC for CVE-2020-6287, CVE-2020-6286 (SAP RECON vulnerability) | |
GitGot | Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets. |
|
Print-My-Shell | Python script wrote to automate the process of generating vari ous reverse shells. |
|
firmwalker | Script for searching the extracted firmware file system for go odies! |
|
CVE-2020-1472 | PoC for Zerologon - all research credits go to Tom Tervoort of Secura |
|
tget | tget is wget for torrents | |
pentest-wiki | PENTEST-WIKI is a free online security knowledge library for p entesters / researchers. If you have a good idea, please share it with others. |
|
synner | A TCP SYN flood client written in Rust, powered by libpnet | |
CVE-2020-15148-by passes |
几条关于CVE-2020-15148(yii2反序列化)的绕过 | |
cve-2020-14386 | ||
memshell | mxd_reb ehinder_ v3_0_5 |
Tomcat 冰蝎内存马。 |
xvwa | XVWA is a badly coded web application written in PHP/MySQL tha t helps security enthusiasts to learn application security. |
|
cupp | Common User Passwords Profiler (CUPP) | |
AhMyth-Android-RA T |
Android Remote Administration Tool | |
CVE-2020-0787-EXP -ALL-WINDOWS-VERSI ON |
1 | Support ALL Windows Version |
POC-T | 2.0.5 | 渗透测试插件化并发框架 / Open-sourced remote vulnerability PoC /EXP framework |
ysoserial-mangguo gan |
||
ICS-Protocol-iden tify |
Using nmap NSE scripts for identifying common ICS protocols[使 用nmap的nse脚本对常见工控协议进行识别,附对应nse脚本,并记录pcap 流量] |
|
snmpwn | An SNMPv3 User Enumerator and Attack tool | |
wait-for-it | Pure bash script to test and wait on the availability of a TCP host and port |
|
Bad-Pdf | v1.1 | Steal Net-NTLM Hash using Bad-PDF |
PowerSploit | v3.0.0 | PowerSploit - A PowerShell Post-Exploitation Framework |
jmet | 0.1.0 | Java Message Exploitation Tool |
CS-checklist | v1.0 | PC客户端(C-S架构)渗透测试checklist / Client side(C-S) penetr ation checklist |
Nmap-Tools | SpiderLabs shared Nmap Tools | |
mole | v0.1 | Mole is a framework for identifying and exploiting out-of-band application vulnerabilities. |
shiroPoc | 0.0.05 | |
MSSQL_BackDoor | ||
OSCP | OSCP | |
Exploit-Framework | 🔥 An Exploit framework for Web Vulnerabilities written in Python |
|
google_dork_list | Google Dorks | |
CAS_EXP | 0.0.1 | CAS 硬编码 远程代码执行漏洞 |
Serverless-Top-10 -Project |
1.0 | OWASP Serverless Top 10 |
kostebek | v1.2.0 | |
Intensio-Obfuscat or |
Obfuscate a python code 2.x and 3.x | |
CVE-2020-8559 | This is a PoC exploit for CVE-2020-8559 Kubernetes Vulnerabili ty |
|
PE2HTML | Injects HTML/PHP/ASP to the PE | |
CVE-2020-6287-exp loit |
PoC for CVE-2020-6287 The PoC in python for add user only, no administrator permission set. Inspired by @zeroSteiner from met asploit. Original Metasploit PR module: https://github. |
|
smogcloud | Find cloud assets that no one wants exposed 🔎 ☁️ | |
memtriage | v0.3.2- alpha |
Allows you to quickly query a Windows machine for RAM artifact s |
CVE-2020-1350-DoS | A denial-of-service proof-of-concept for CVE-2020-1350 | |
Exploits | Exploits for various CVEs | |
crowbar | v4.2 | Crowbar is brute forcing tool that can be used during penetrat ion tests. It is developed to support protocols that are not cu rrently supported by thc-hydra and other popular brute |
f5-bigip-rce-cve- 2020-5902 |
F5 BIG-IP RCE CVE-2020-5902 automatic check tool | |
CVE-2020-11651-po c |
PoC exploit of CVE-2020-11651 and CVE-2020-11652 | |
cobalt_strike_bot | ||
SMBGhost_RCE_PoC | ||
PocCollect | Poc Collected for study and develop | |
ripple20-poc | Treck Network Stack Discovery Tool by JSOF | |
LeakLooker | Find open databases - Powered by Binaryedge.io | |
Reptile | 2.0 | LKM Linux rootkit |
tomcat_nofile_web shell |
Tomcat基于动态注册Filter的无文件Webshell | |
cve-2020-1054 | LPE for CVE-2020-1054 targeting Windows 7 x64 | |
CVE-2020-1066-EXP | exp | CVE-2020-1066-EXP支持Windows 7和Windows Server 2008 R2操作系统 |
Spring-Boot-Actua tor-Exploit |
Spring Boot Actuator (jolokia) XXE/RCE | |
XssPy | XssPy - Web Application XSS Scanner | |
LSB-Steganography | Python program to steganography files into images using the Le ast Significant Bit. |
|
CallStranger | Vulnerability checker for Callstranger (CVE-2020-12695) | |
BadDNS | v1.0.1 | |
ICSim | Instrument Cluster Simulator | |
Vulnerability-goa pp |
Web application build Golang with Vulnerability | |
VpsEnvInstall | 一键部署渗透VPS | |
factordb-python | 1.3.0 | FactorDB client library with Python |
RedisWriteFile | 通过 Redis 主从写出无损文件 | |
CVE-2020-3153 | Cisco AnyConnect < 4.8.02042 privilege escalation through path traversal |
|
Pentest_Interview | 个人准备渗透测试和安全面试的经验之谈,和去部分厂商的面试题,干 货真的满满~ |
|
redis-ssrf | redis ssrf gopher generater & redis ssrf to rce by master-slav e-sync |
|
SB-Actuator | Spring Boot Actuator未授权访问【XXE、RCE】单/多目标检测 | |
flashsploit | Exploitation Framework for ATtiny85 Based HID Attacks | |
tomcat-cluster-se ssion-sync-exp |
tomcat使用了自带session同步功能时,不安全的配置(没有使用Encry ptInterceptor)导致存在的反序列化漏洞,通过精心构造的数据包, 可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不 是CVE-2020-9484,9484是session持久化的洞,这个是session集群同步 的洞! |
|
CVE-2020-10199 | CVE-2020-10199 回显版本 | |
RDODecrypt | Remote Desktop Organizer 密码破解 | |
CAAC-CTF-2018-Pri mary |
2018年民航网络安全职业技能竞赛-初赛 | |
writeups | 昔書いたctfライトアップなど | |
mssqli-duet | SQL injection script for MSSQL that extracts domain users from an Active Directory environment based on RID bruteforcing |
|
cve-2020-11651-ex p-plus |
||
isf | v0.1.0 | ISF(Industrial Control System Exploitation Framework),a explo itation framework based on Python |
static-binaries | Various *nix tools built as statically-linked binaries | |
asset | NMAP扫描网络资产自动导入到Elasticstack进行展示 | |
MassBleed | MassBleed SSL Vulnerability Scanner | |
awesome-shodan-qu eries |
🔍 A collection of interesting, funny, and depressing search q ueries to plug into shodan.io 👩💻 |
|
vmware_vcenter_cv e_2020_3952 |
Exploit for CVE-2020-3952 in vCenter 6.7 | |
android-malware | Collection of android malware samples | |
assetfinder | Find domains and subdomains related to a given domain | |
redis-rce | Redis RCE 的几种方法 | |
Xray_and_crwlergo _in_server |
雇一位免费的360工程师和一位长亭工程师为你挖洞,还有听话的serve r酱给你汇报 |
|
CVE-2020-0796 | v1.0 | CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost |
nyancat | 1.2.1 | Nyancat in your terminal, rendered through ANSI escape sequenc es. This is the source for the Debian package nyancat. |
linux-kernel-expl oits |
linux-kernel-exploits Linux平台提权漏洞集合 | |
o365enum | Enumerate valid usernames from Office 365 using ActiveSync, Au todiscover v1, or office.com login page. |
|
CrackSleeve | 破解CS4.0 | |
cve-2019-1040-sca nner |
||
CVE-2020-0688 | Exploit and detect tools for CVE-2020-0688 | |
CVE-2019-1040-dcp wn |
CVE-2019-1040 with Kerberos delegation | |
OA-tongda-RCE | Office Anywhere网络智能办公系统 | |
IoT_Sec_Tutorial | IoT安全教程 | |
CVE-2019-1388 | guest→system(UAC手动提权) | |
motd | My funny motd config. Just for fun! | |
emergency-respons e-checklist |
1.0 | 应急响应指南 / emergency response checklist |
hack_postgres | 便捷地使用PostgreSQL自定义函数来执行系统命令,适用于数据库管理 员知道postgres密码却不知道ssh或RDP密码的时候在服务器执行系统命令 。 |
|
CVE-2020-9548 | CVE-2020-9548:FasterXML/jackson-databind 远程代码执行漏洞 | |
CVE-2020-9547 | CVE-2020-9547:FasterXML/jackson-databind 远程代码执行漏洞 | |
leaky-repo | 1.1.2 | Benchmarking repo for secrets scanning |
cve-2020-0688 | cve-2020-0688 | |
javasec_study | java代码审计学习笔记 | |
Spray-AD | A Cobalt Strike tool to audit Active Directory user accounts f or weak, well known or easy guessable passwords. |
|
CVE-2020-8813 | The official exploit for Cacti v1.2.8 Remote Code Execution CV E-2020-8813 |
|
CNVD-2020-10487-T omcat-Ajp-lfi |
Tomcat-Ajp协议文件读取漏洞 | |
CVE-2020-0668 | Use CVE-2020-0668 to perform an arbitrary privileged file move operation. |
|
updog | 1.4 | Updog is a replacement for Python's SimpleHTTPServer. It allow s uploading and downloading via HTTP/S, can set ad hoc SSL cert ificates and use http basic auth. |
SiteCopy | sitecopy is a tool that facilitates personal website backup an d network data collection |
|
jieba | v0.42.1 | 结巴中文分词 |
Bashfuscator | A fully configurable and extendable Bash obfuscation framework . This tool is intended to help both red team and blue team. |
|
SharpToolsAggress or |
内网渗透中常用的c#程序整合成cs脚本,直接内存加载。持续更新~ | |
WDExtract | Extract Windows Defender database from vdm files and unpack it | |
bucket-stream | Find interesting Amazon S3 Buckets by watching certificate tra nsparency logs. |
|
CVE-2019-8449 | CVE-2019-8449 Exploit for Jira v2.1 - v8.3.4 | |
ffuf-scripts | Scripts to help with different ffuf tasks and workflows | |
lmg | Script for automating Linux memory capture and analysis | |
CVE-2018-0296 | Script to test for Cisco ASA path traversal vulnerability (CVE -2018-0296) and extract system information. |
|
spring-boot-actua tor-h2-rce |
Sample Spring Boot App Demonstrating RCE via Exposed env Actua tor and H2 Database |
|
PrivExchange | Exchange your privileges for Domain Admin privs by abusing Exc hange |
|
cve-2019-19781 | This is a tool published for the Citrix ADC (NetScaler) vulner ability. We are only disclosing this due to others publishing t he exploit code first. |
|
at-ps | Adversary Tactics - PowerShell Training | |
CVE-2019-0708-EXP -Windows |
1.0 | CVE-2019-0708-EXP-Windows版单文件exe版,运行后直接在当前控制台 反弹System权限Shell |
SharpNetCheck | ||
docker_mirror | v1.0 | 查找最快的docker镜像 |
Xiaomi_Mi_WiFi_R3 G_Vulnerability_PO C |
A login bypass(CVE-2019-18371) and a command injection vulnera bility(CVE-2019-18370) in Xiaomi Router R3G up to version 2.28. 23. |
|
CVE-2019-19781 | Citrix ADC Remote Code Execution | |
LLC | Linux Log Cleaner (utmp, wtmp, btmp, lastlog) | |
CVE-2019-1215 | ||
hsd-cipher-sm | 国产密码算法SM2,SM3,SM4 | |
ICS-pcap | A collection of ICS/SCADA PCAPs | |
Vxscan | python3写的综合扫描工具,主要用来存活验证,敏感文件探测(目录扫 描/js泄露接口/html注释泄露),WAF/CDN识别,端口扫描,指纹/服务识 别,操作系统识别,POC扫描,SQL注入,绕过CDN,查询旁站等功能,主 要用来甲方自测或乙方授权测试,请勿用来搞破坏。 |
|
CVE-2019-9810 | 1 | Exploit for CVE-2019-9810 Firefox on Windows 64-bit. |
jd-gui | v1.6.6 | A standalone Java Decompiler GUI |
AssetScan | 资产探测工具,检测存活,检测风险端口,常规端口,全端口探测等等 ,对探测的端口的脆弱面进行安全分析进行 |
|
ClashA | 0.0.3.9 | A Android GUI for Clash |
wordpress-dos-poc | WordPress <= 5.3.? DoS | |
how-does-MobaXter m-encrypt-password |
This repo offers a tool to reveal password encrypted by MobaXt erm. |
|
how-does-Xmanager -encrypt-password |
This is a repo to tell you how Xmanager (XFtp, XShell) encrypt password. Transferred from https://github.com/DoubleLabyrinth/ how-does-Xmanager-encrypt-password |
|
Probable-Wordlist s |
v2.0 | Version 2 is live! Wordlists sorted by probability originally created for password generation and testing - make sure your pa sswords aren't popular! |
linux-hardening-c hecklist |
Simple checklist to help you deploying the most important area s of the GNU/Linux production systems - work in progress. |
|
gogsownz | Gogs CVEs | |
idcardgenerator | win_v1. 3 |
身份证图片生成工具 generate an id card picture |
ThreatHound | ThreatHound is a threat intelligence query tool use for detect ing potentially malicious IP or domains. It combines the MISP o pen source threat intelligence sharing platform as its |
|
EBurst | 这个脚本主要提供对Exchange邮件服务器的账户爆破功能,集成了现有 主流接口的爆破方式。 |
|
Cisco-UCM-SQLi-sc ripts |
Scripts that can be used to exploit CVE-2019-15972 which was a n Authenticated SQLi issue in Cisco Unified Call Manager (UCM). |
|
genpAss | ||
massh-enum | OpenSSH 2.3 up to 7.4 Mass Username Enumeration (CVE-2018-1547 3). |
|
SHIRO-721 | RememberMe Padding Oracle Vulnerability RCE | |
RdpThief | Extracting Clear Text Passwords from mstsc.exe using API Hooki ng. |
|
Diggy | Extract endpoints from apk files. | |
phuip-fpizdam | Exploit for CVE-2019-11043 | |
CVE-2017-1000353 | 1.1 | jenkins CVE-2017-1000353 POC |
webmin_cve-2019-1 2840_poc |
A standalone POC for CVE-2019-12840 | |
aws_public_ips | 1.0.7 | Fetch all public IP addresses tied to your AWS account. Works with IPv4/IPv6, Classic/VPC networking, and across all AWS serv ices |
RoarCTF-Writeup-s ome-Source-Code |
没有怎么整理,大家将就看吧,有问题发一个issue给我 | |
CVE-2017-3506 | CVE-2017-3506 | |
CVE-2017-17562 | Standalone Python 3 exploit for CVE-2017-17562 | |
CVE-2019-3396 | Confluence 未授权 RCE (CVE-2019-3396) 漏洞 | |
apache- | apache权限维持后门 | |
patoolkit | v1.0 | PA Toolkit is a collection of traffic analysis plugins focused on security |
snmp_fuzzer | snmp_fuzzer | |
CloudUnflare | Reconnaissance Real IP address for Cloudflare Bypass | |
CVE-2019-7609 | exploit CVE-2019-7609(kibana RCE) on right way by python2 scri pts |
|
Firewall | 美国国家安全局NSA下属方程式黑客组织(Equation Group)被The Sha dow Brokers(影子经纪人)hack出来的并免费分享的源码 |
|
RoarCTF-Writeup-2 019 |
https://github.com/berTrAM888/RoarCTF-Writeup-some-Source-Code .git |
|
cve-2017-18635 | PoC for CVE-2017-18635 | |
Venom | v1.1.0 | Venom - A Multi-hop Proxy for Penetration Testers |
sec-chart | 安全思维导图集合 | |
struts2-057-exp | s2-057 最新漏洞分析和EXP脚本 | |
batch_ping | support multi ping | |
PortTran | PortTran (.NET端口转发工具,支持任意权限) | |
cve-2019-0708 | Metasploit module for massive Denial of Service using #Bluekee p vector. |
|
ispy | ispy V1.0 - Eternalblue(ms17-010)/Bluekeep(CVE-2019-0708) Scan ner and exploit ( Metasploit automation ) |
|
loginlog_windows | 读取登录过本机的登录失败或登录成功的所有计算机信息,在内网渗透 中快速定位运维管理人员。 |
|
CVE-2019-8451 | Jira未授权SSRF漏洞 | |
Vegile | This tool will setting up your backdoor/rootkits when backdoor already setup it will be hidden your spesisifc process,unlimit ed your session in metasploit and transparent. Even whe |
|
rtcp | v0.1.0 | 利用 Python 的 Socket 端口转发,用于远程维护 |
CVE-2019-10392 | CVE-2019-10392 RCE Jackson with Git Client Plugin 2.8.2 (Authe nticated) |
|
APTnotes | Various public documents, whitepapers and articles about APT c ampaigns |
|
as_webshell_venom | 免杀webshell无限生成工具蚁剑版 | |
CVE-2019-1579 | ||
ACLight | A script for advanced discovery of Privileged Accounts - inclu des Shadow Admins |
|
CVE-2019-1132 | EoP POC for CVE-2019-1132 | |
secscan-authcheck | v0.1 | 越权检测工具 |
BlueKeep | Proof of concept for CVE-2019-0708 | |
RSA-In-CTF | ||
CVE-2019-11510 | Exploit for Arbitrary File Read on Pulse Secure SSL VPN (CVE-2 019-11510) |
|
fastjson_gadgets_ scanner |
||
CVE-2019-15642 | Webmin Remote Code Execution (authenticated) | |
staffdb | ||
AggressorScript-C reateCloneHiddenAc count |
创建一个克隆隐藏的管理员账号/Create a Clone Hidden Administrat or Account |
|
GoogleHacking-Pag e |
This is a summary of my study and use of Google hacking. I hop e I can share it with you. If you like, please give me a star o r fork it, thank you. |
|
30min_guides | 覃健祥的学习笔记,各种几十分钟入门的文档 | |
RedTeam-BCS | BCS(北京网络安全大会)2019 红队行动会议重点内容 | |
CVE-2017-12149 | Jboss Java Deserialization RCE (CVE-2017-12149) | |
Subdomain-Takeove r |
一个子域名接管检测工具 | |
CVE-2019-7238 | Nexus Repository Manager 3 Remote Code Execution without authe ntication < 3.15.0 |
|
RSA-ATTACK | RSA加密应用常见缺陷的原理与实践 | |
CVE-2018-13379 | CVE-2018-13379 | |
CVE-2018-13382 | CVE-2018-13382 | |
Kayak | untagge d-359703 9ad20ce9 798a99 |
Kayak is a CAN bus analysis tool based on SocketCAN |
CVE-2019-2725 | CVE-2019-2725 命令回显 | |
halive | A fast http and https prober, to check which URLs are alive | |
sec_tools | ||
Jackson_RCE-CVE-2 019-12384 |
CVE-2019-12384 漏洞测试环境 | |
Nmap_Bypass_IDS | Nmap&Zmap特征识别,绕过IDS探测 | |
CVE-2019-13272 | Linux 4.10 < 5.1.17 PTRACE_TRACEME local root | |
BB-Tips | Collection of Bug Bounty Tips | |
InfinityHook | Hook system calls, context switches, page faults and more. | |
golang-developer- roadmap-cn |
在 2019 成为一名 Go 开发者的路线图。为学习 Go 的人而准备。 | |
CVE-2019-12384 | Jackson Rce For CVE-2019-12384 | |
BKScan | BlueKeep scanner supporting NLA | |
CVE-2019-11580 | CVE-2019-11580 Atlassian Crowd and Crowd Data Center RCE | |
discuz-ml-rce | discuz ml rce | |
Red-Baron | Automate creating resilient, disposable, secure and agile infr astructure for Red Teams. |
|
LuCI_RCE_exp | Exp of cve-2019-12272 | |
RedisModules-Exec uteCommand |
Tools, utilities and scripts to help you write redis modules! | |
redis-rogue-serve r |
Redis 4.x & 5.x RCE | |
zoom_vulnerabilit y_poc |
||
instantbox | 📦 Get a clean, ready-to-go Linux box in seconds. | |
CTF | 保存有关自己做的 CTF 题目 | |
Cipher_Encryption _Type_Identificati on |
对密文的加密类型进行判断的命令行工具。 | |
dics | ||
security | Some of my security stuff and vulnerabilities. Nothing advance d. More to come. |
|
jenkins-rce | 😈 Jenkins RCE PoC. From unauthenticated user to re mote code execution, it's a hacker's dream! |
|
rdpscan | A quick scanner for the CVE-2019-0708 "BlueKeep" vulnerability . |
|
docker-vulnerabil ity-environment |
Use the docker to build a vulnerability environment | |
Nessus_to_report | Nessus中文报告自动化脚本 | |
Serverless-Goat | OWASP ServerlessGoat: a serverless application demonstrating c ommon serverless security flaws |
|
aquatone | v1.7.0 | A Tool for Domain Flyovers |
awesome-jenkins-r ce-2019 |
There is no pre-auth RCE in Jenkins since May 2017, but this i s the one! |
|
CVE-2019-0803 | Win32k Elevation of Privilege Poc | |
CVE-2019-2615 | ||
XAntiDebug | VMProtect 3.x Anti-debug Method Improved | |
WSPIH | Website Sensitive Personal Information Hunter 网站个人敏感信息 文件扫描器 |
|
S9MF-php-webshell -bypass |
为方便WAF入库的项目 | |
CapOS | 等级保护测评windows工具源码 | |
yujianrdpcrack | 御剑RDP爆破工具 | |
lor-axe | 🪓 a multi-threaded, low-bandwidth HTTP DOS tool | |
Hosts_scan | 这是一个用于IP和域名碰撞匹配访问的小工具,旨意用来匹配出渗透过 程中需要绑定hosts才能访问的弱主机或内部系统。 |
|
cve-2018-1273 | Spring Data Commons RCE 远程命令执行漏洞 | |
CNVD-C-2019-48814 -COMMON |
CNVD-C-2019-48814 poc work on linux and windows | |
Threat-Intelligen ce-Analyst |
威胁情报,恶意样本分析,开源Malware代码收集 | |
BlueCommand | Dashboarding and Tooling front-end for PowerShell Empire using PowerShell Universal Dashboard |
|
CVE-2019-3396_EXP | CVE-2019-3396 confluence SSTI RCE | |
vlany | Linux LD_PRELOAD rootkit (x86 and x86_64 architectures) | |
w8fuckcdn | Get website IP address by scanning the entire net 通过扫描全网 绕过CDN获取网站IP地址 |
|
RW_Password | 此项目用来提取收集以往泄露的密码中符合条件的强弱密码 | |
UPGDSED | v1.1.2 | Universal PatchGuard and Driver Signature Enforcement Disable |
SQLInjectionWiki | 一个专注于聚合和记录各种SQL注入方法的wiki | |
sas-top-10 | Serverless Architectures Security Top 10 Guide | |
phpinfo_scanner | 一个抓取phpinfo重要信息的小工具 | |
Win-Logs-Parse-to ol |
||
BlockRDPBrute | [HIPS]RDP(3389)爆破防护 | |
acefile | POC of https://research.checkpoint.com/extracting-code-executi on-from-winrar/ |
|
awesome-serverles s-security |
A curated list of awesome serverless security resources such a s (e)books, articles, whitepapers, blogs and research papers. |
|
CVE-2019-7238 | 🐱💻 Poc of CVE-2019-7238 - Nexus Repository Manager 3 Remot e Code Execution 🐱💻 |
|
CVE-2018-20250 | exp for https://research.checkpoint.com/extracting-code-execut ion-from-winrar |
|
cve-2019-1003000- jenkins-rce-poc |
Jenkins RCE Proof-of-Concept: SECURITY-1266 / CVE-2019-1003000 (Script Security), CVE-2019-1003001 (Pipeline: Groovy), CVE-20 19-1003002 (Pipeline: Declarative) |
|
JavaID | java source code static code analysis and danger function iden tify prog |
|
ja3_4java | Java library for SSL/TLS ja3 fingerprint | |
SharpShooter | Payload Generation Framework | |
Kali-learning-not es |
Write down some kali learning notes | |
CiscoRV320Dump | CVE-2019-1652 /CVE-2019-1653 Exploits For Dumping Cisco RV320 Configurations & Debugging Data AND Remote Root Exploit! |
|
SharpDump | SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 funct ionality. |
|
bugcrowd-levelup- subdomain-enumerat ion |
This repository contains all the material from the talk "Esote ric sub-domain enumeration techniques" given at Bugcrowd LevelU p 2017 virtual conference |
|
Digispark-Duckdui no |
Poor man's rubber ducky | |
impacket-examples -windows |
v0.9.17 | The great impacket example scripts compiled for Windows |
mijisou | Privacy-respecting metasearch engine | |
bypass_disablefun c_via_LD_PRELOAD |
bypass disable_functions via LD_PRELOA (no need /usr/sbin/send mail) |
|
webshell | 入侵分析时发现的Webshell后门 | |
icsmaster | ICS/SCADA Security Resource(整合工控安全相关资源) | |
Paper | Web Security Technology & Vulnerability Analysis Whitepapers | |
CVE-2018-8581 | CVE-2018-8581 | |
rdpwrap | v1.6.2 | RDP Wrapper Library |
CTF-Training | 收集各大比赛的题目和Writeup | |
SharpPack | An Insider Threat Toolkit | |
cve-2018-1002105 | Test utility for cve-2018-1002105 | |
poc_CVE-2018-1002 105 |
PoC for CVE-2018-1002105. | |
Invoke-TheHash | PowerShell Pass The Hash Utils | |
CVE-2018-0296 | v0.0.4 | Test CVE-2018-0296 and extract usernames |
CVE-2018-3252 | CVE-2018-3252-PoC | |
SessionGopher | SessionGopher is a PowerShell tool that uses WMI to extract sa ved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Des |
|
riscv-ida | RISC-V ISA processor module for IDAPro 7.x | |
NATBypass | 一款lcx在golang下的实现, 可用于内网穿透, 建立TCP反弹隧道用以绕 过防火墙入站限制等, A tool for establish reverse tunnel for NAT network environment and proxy, support all functions of lcx.exe |
|
JQShell | A weaponized version of CVE-2018-9206 | |
CVE-2017-7269-Ech o-PoC |
CVE-2017-7269 回显PoC ,用于远程漏洞检测.. | |
CVE-2018-2893 | CVE-2018-2893-PoC | |
XXEpayload | ||
CVE-2018-9206 | A Python PoC for CVE-2018-9206 | |
SpoolerScanner | Check if MS-RPRN is remotely available with powershell/c# | |
modbus-cli | Modbus command line utility | |
base100 | base💯 - Encode your data into emoji | |
wavecrack | v1.0 | Wavestone's web interface for password cracking with hashcat |
luacheck | 0.23.0 | A tool for linting and static analysis of Lua code. |
Internal-Monologu e |
Internal Monologue Attack: Retrieving NTLM Hashes without Touc hing LSASS |
|
me_cleaner | v1.2 | Tool for partial deblobbing of Intel ME/TXE firmware images |
SpoolSample | PoC tool to coerce Windows hosts authenticate to other machine s via the MS-RPRN RPC interface. This is possible via other pro tocols as well. |
|
dictionary | List of some dictionaries | |
Win2016LPE | Windows10 & Windows Server 2016 LPE Exploit (use schedsvc!SchR pcSetSecurity()) |
|
SM2Java | 国密SM2,SM3 Java实现 | |
write-ups-2015 | Wiki-like CTF write-ups repository, maintained by the communit y. 2015 |
|
CVE-2018-8420 | 原PoC甚至符号都打错了!太不走心了! | |
CVE-2018-15473-Ex ploit |
Exploit written in Python for CVE-2018-15473 with threading an d export formats |
|
butterfly | A web terminal based on websocket and tornado | |
ASWCrypter | An Bash&Python Script For Generating Payloads that Bypasses Al l Antivirus so far [FUD] |
|
EventCleaner | A tool mainly to erase specified records from Windows event lo gs, with additional functionalities. |
|
PHP_Code_Challeng e |
总结一些php代码审计ctf练习题 | |
Pass-to-hash-EWS | ||
MITMf | v0.9.8 | Framework for Man-In-The-Middle attacks |
ueditor-getshell | ueditor .net getshell | |
mscache | a tool to manipulate dcc(domain cached credentials) in windows registry, based mainly on the work of mimikatz and impacket |
|
ExchangeRelayX | An NTLM relay tool to the EWS endpoint for on-premise exchange servers. Provides an OWA for hackers. |
|
DotNetToJScript | v1.0.4 | A tool to create a JScript file which loads a .NET v2 assembly from memory. |
CVE-2018-8120 | CVE-2018-8120 Exploit for Win2003 Win2008 WinXP Win7 | |
CTF-RSA | 总结一下各路大师傅的RSA脚本233 | |
OSCE | Collection of things made during my preparation to take on OSC E |
|
CVE-2018-2628 | CVE-2018-2628 & CVE-2018-2893 | |
OSCE | Some exploits, which I’ve created during my OSCE preparation. | |
redis_lua_exploit | ||
checkO365 | checkO365 is a tool to check if a target domain is using O365 | |
CiscoSmartInstall Exploit |
||
Prowl | ||
poc-cve-2018-1273 | POC for CVE-2018-1273 | |
Convert-Invoke-Ke rberoast |
Converts the output from Invoke-Kerberoast into hashcat format . |
|
CVE-2018-8174_EXP | CVE-2018-8174_python | |
naive-hashcat | Crack password hashes without the fuss 🐈 | |
CVE-2018-8174-msf | CVE-2018-8174 - VBScript memory corruption exploit. | |
java-deserializat ion-exploits |
A collection of curated Java Deserialization Exploits | |
CVE-2018-1111 | CVE-2018-1111 DynoRoot | |
CVE-2018-1111 | Environment for DynoRoot (CVE-2018-1111) | |
GPON | Exploit for Remote Code Execution on GPON home routers (CVE-20 18-10562) written in Python. Initially disclosed by VPNMentor ( https://www.vpnmentor.com/blog/critical-vulnerability-g |
|
CVE-2018-9995_dvr _credentials |
(CVE-2018-9995) Get DVR Credentials | |
Mind-Map | 各种安全相关思维导图整理收集 | |
cloud-torrent | 0.8.25 | ☁️ Cloud Torrent: a self-hosted remote torrent client |
CVE-2018-7600 | Exploit for Drupal 7 <= 7.57 CVE-2018-7600 | |
ProcessInjection | Some ways to inject a DLL into a alive process | |
scan-backup-langz i- |
扫描备份文件和敏感信息泄漏的扫描器,速度快,器大活好 | |
CVE-2018-2380 | PoC of Remote Command Execution via Log injection on SAP NetWe aver AS JAVA CRM |
|
BypassCaiDao | 过WAF菜刀 | |
clairctl | v1.2.8 | Tracking container vulnerabilities with Clair Control for Core OS Clair |
TextMining | Python文本挖掘系统 Research of Text Mining System | |
vncpwd | v0.1 | VNC Password Decrypter |
nextnet | v0.0.2 | nextnet is a pivot point discovery tool written in Go. |
CANoodler | CANoolder: CAN to 3.3V logic level interface. Dumb. Cheap. Sim ple. Pick 3. |
|
inSp3ctor | AWS S3 Bucket/Object Finder | |
suricata-traffici d |
Application and service identification rules for Suricata | |
NtlmRelayToEWS | ntlm relay attack to Exchange Web Services | |
spectre-attack | Example of using revealed "Spectre" exploit (CVE-2017-5753 and CVE-2017-5715) |
|
cisco-snmp-rce | Cisco IOS SNMP RCE PoC | |
KPTI-PoC-Collecti on |
Meltdown/Spectre PoC src collection. | |
danderspritz-evtx | v1.0 | Parse evtx files and detect use of the DanderSpritz eventloged it module |
rce-over-spark | Remote Command Execution Over Spark | |
Invoke-WCMDump | PowerShell Script to Dump Windows Credentials from the Credent ial Manager |
|
S2-055-PoC | S2-055的环境,基于rest-show-case改造 | |
DigiKeyboard_DE | angepasste Header-Dateien für Deutsches Tastatur Layout | |
HugeDirtyCowPOC | A POC for the Huge Dirty Cow vulnerability (CVE-2017-1000405) | |
CVE-2017-11882 | Proof-of-Concept exploits for CVE-2017-11882 | |
CVE-2017-11882 | CVE-2017-11882 from https://github.com/embedi/CVE-2017-11882 | |
evolve | v1.6 | Web interface for the Volatility Memory Forensics Framework |
CVE-2017-0199 | v4.0.1 | Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could ge |
CACTUSTORCH | CACTUSTORCH: Payload Generation for Adversary Simulations | |
PTP-RAT | Exfiltrate data over screen interfaces | |
awvs_script_decod e |
解密好的AWVS10.5 data/script/目录下的脚本 | |
CVE-2017-8759 | CVE-2017-8759 | |
SAP-Pentest | ||
volatility-plugin s |
Plugins I've written for Volatility | |
Python-Brainfuck | Just a small Brainfuck interpreter written in Python | |
Sensitive-word | 收集的一些敏感词汇,挺全的,还细分了暴恐词库、反动词库、民生词 库、色情词库、贪腐词库、其他词库等 |
|
MSSQL-Fileless-Ro otkit-WarSQLKit |
Bildiğiniz üzere uzun zamandır MSSQL üzerine çalışmalar yapmak tayım. Bu yazımda uzun zamandır uğraştığım bir konuyu ele alaca ğım, MSSQL Rootkit. Bildiğiniz üzere şimdiye kadar MS-S |
|
DigistumpArduino | 1.6.7 | Files to add Digistump support (Digispark, Pro, DigiX) to Ardu ino 1.6.X (1.6.5+) |
dnsAutoRebinding | ssrf、ssrfIntranetFuzz、dnsRebinding、recordEncode、dnsPoisoni ng、Support ipv4/ipv6 |
|
outguess | An unmaintained fork of the OutGuess steganographic tool. Try https://github.com/resurrecting-open-source-projects/outguess f or possibly a better option. |
|
joffrey | Stupid MQTT Brute Forcer | |
csrf-poc-generato r |
this html file creates a csrf poc form to any http request. | |
Struts2-048 | CVE-2017-9791 | |
wydomain | to discover subdomains of your target domain | |
RiskySPN | Detect and abuse risky SPNs | |
wifi_keylogger | DIY Arduino Wi-Fi Keylogger (Proof of Concept) | |
Exploits | Windows Exploits | |
sandcastle | 🏰 A Python script for AWS S3 bucket enumeration. | |
PocCollect | a plenty of poc based on python | |
ffmpeg-avi-m3u-xb in |
||
WindowsExploits | Windows exploits, mostly precompiled. Not being updated. Check https://github.com/SecWiki/windows-kernel-exploits instead. |
|
Go-For-OSCP | ||
cve-2017-7269-too l |
CVE-2017-7269 to webshell or shellcode loader | |
vulnd_xxe | A server vulnerable to XXE that can be used to test payloads u sing the xxer tool. |
|
aeskeyfind | Fork of aeskeyfind that knows more formats of AES key schedule | |
filterbypass | Browser's XSS Filter Bypass Cheat Sheet | |
kernel-exploits | ||
icmptunnel | v1.0.0 | Transparently tunnel your IP traffic through ICMP echo and rep ly packets. |
hotoloti | documentation, scripts, tools related to Zena Forensics (http: //blog.digital-forensics.it) |
|
IllegalWordsDetec tion |
提供高效率的较简单的Unity3d手游客户端的敏感词检测的算法,能应 付大部分敏感词过滤需求 |
|
cve-2017-7269 | fixed msf module for cve-2017-7269 | |
ZeroNights-HackQu est-2016 |
2 web tasks from ZeroNights HackQuest 2016 | |
CVE-2016-5195 | A CVE-2016-5195 exploit example. | |
SensitiveWordFilt er |
机器学习实现敏感词过滤 | |
duck2spark | Converter for raw RubberDucky payloads to Digispark Arduino ID E Sketch source. |
|
dirtycow-vdso | PoC for Dirty COW (CVE-2016-5195) | |
MSSQL-SQLi-Labs | ||
Windows-Exploit-S uggester |
This tool compares a targets patch levels against the Microsof t vulnerability database in order to detect potential missing p atches on the target. It also notifies the user if ther |
|
docker-remote-api -exp |
docker remote api未授权访问的利用代码 | |
ShellcodeWrapper | Shellcode wrapper with encryption for multiple target language s |
|
VolUtility | v1.2 | Web App for Volatility framework |
winscppasswd | 1.0 | WinSCP Password Extractor/Decrypter/Revealer written in go lan guage |
public | my public code | |
luadec | Lua Decompiler for lua 5.1 , 5.2 and 5.3 | |
ew | 内网穿透(跨平台) | |
xss | php写的个人研究测试用的 xss cookie 攻击管理平台,开源出来 | |
weakfilescan | 动态多线程敏感信息泄露检测工具 | |
peepdf | Powerful Python tool to analyze PDF documents | |
FingerPrint | web应用指纹识别 | |
SCADAPASS | 1.2 | SCADA StrangeLove Default/Hardcoded Passwords List |
ssh-audit | SSH server auditing (banner, key exchange, encryption, mac, co mpression, compatibility, security, etc) |
|
dirtycow-docker-v dso |
||
MySQL-Monitor | MySQL服务器执行SQL记录实时监控(WEB版本) | |
linux-inject | Tool for injecting a shared object into a Linux process | |
sensitive-stop-wo rds |
互联网常用敏感词、停止词词库 | |
Conveigh | Conveigh is a Windows PowerShell LLMNR/NBNS spoofer detection tool |
|
armitage | Automatically exported from code.google.com/p/armitage | |
DirBrute | 多线程WEB目录爆破工具 [Multi-thread WEB directory blasting too l(with dics inside) ] |
|
browser-dumpwd | Dump browser passwords(chrome, firefox) with sqlite3 lib. | |
PoCs | Proof of Concepts for CVE-2016–3714 | |
docker_api_vul | docker 未授权访问漏洞利用脚本 | |
cub3 | Proof of concept for LD_PRELOAD malware that uses extended att ributes to protect files. |
|
ios-malware | iOS malware samples | |
foolav | v1.0 | Pentest tool for antivirus evasion and running arbitrary paylo ad on target Wintel host |
vulnapp | use docker to attack web as a demo | |
ysoserial | A proof-of-concept tool for generating payloads that exploit u nsafe Java object deserialization. |
|
Redpoint | Digital Bond's ICS Enumeration Tools | |
windows-exploits | Used for the osce exam preparation | |
CVE-2015-7547 | Proof of concept for CVE-2015-7547 | |
ntdsxtract | Active Directory forensic framework | |
getsystem-offline | Small tool to get a SYSTEM shell | |
Jenkins | Jenkins漏洞探测、用户抓取爆破 | |
clusterd | 0.5 | application server attack toolkit |
FBI-WARNING-in-co nsole |
FBI-WARNING-in-console | |
PLCinject | ||
PixelJihad | A JavaScript steganography tool | |
PowerShell-AD-Rec on |
PowerShell Scripts I find useful | |
dnsenum | 1.2.4.2 | dnsenum is a perl script that enumerates DNS information |
Unix-Privilege-Es calation-Exploits- Pack |
Exploits for getting local root on Linux, BSD, AIX, HP-UX, Sol aris, RHEL, SUSE etc. |
|
rtsp_authgrinder | A authentication brute forcing tool for the rtsp protocol | |
winshock-test | Bash script that tests if a system is Winshock (MS14-066) vuln erable |
|
UPnP-Pentest-Tool kit |
UPnP Pentest Toolkit for Windows | |
shellshock_scanne r |
Python Scanner for "ShellShock" (CVE-2014-6271) | |
kjackal | Linux Rootkit Scanner | |
Linux_Exploit_Sug gester |
Linux Exploit Suggester; based on operating system release num ber |
|
shellcode_launche r |
Shellcode launcher utility | |
thc-pptp-bruter | [Mirror] thc.org uses a CA that is not trusted on a base Arch system so we are mirroring some source here. |
|
vipasswordict | Vietnamese Password Dicts | |
tsh | Tiny SHell is an open-source UNIX backdoor. | |
Rogue-MySql-Serve r |
Rogue MySql Server | |
ReflectiveDLLInje ction |
Reflective DLL injection is a library injection technique in w hich the concept of reflective programming is employed to perfo rm the loading of a library from memory into a host pro |
|
pwnginx | Pwn nginx - a nginx backdoor provides shell access, socks5 tun neling, http password sniffing. |
|
BurpAuthzPlugin | ||
lib_mysqludf_sys | A UDF library with functions to interact with the operating sy stem. These functions allow you to interact with the execution environment in which MySQL runs. |
|
base92 | Implementations of base92 in various languages (C, python) | |
h3c-pt-tools | Huawei/H3C/HP Penetration Testing Tools | |
evilarc | Create tar/zip archives that can exploit directory traversal v ulnerabilities |
|
crawlergo | ||
CVE-2020-1938 | ||
Emergency | ||
Cas_Exploit | ||
Shiro-721 | ||
CTF-RSA-tool | ||
security | ||
sangfor-edr-explo it |
||
CTFCrackTools | ||
PrintNightmare | ||
VolDiff | ||
graphql-voyager | ||
OSCE-Exploit-Deve lopment |
||
searx | ||
cobaltstrike-bof- toolset |
||
fuzz | ||
company-crawler | ||
metarget | ||
WordPress_4 | ||
Hyuga | ||
debugtron | ||
fastjson-1 | ||
privilege-escalat ion-awesome-script s-suite |
||
idea-project-fish -exploit |
||
code-server | ||
CVE-2021-26855 | ||
pcap_dnsproxy | ||
follina | ||
cas4 | ||
odoh-server-go | ||
nps | ||
snort-rules | ||
impacket | ||
PatchAMSI | ||
VirusTotalC2 | ||
names | ||
IPList | ||
nginxconfig | ||
RouterScan-consol e |
||
dirtycow | ||
HealthChecker | ||
clash | ||
testssl | ||
RCE-0-day-for-Gho stScript-9 |
||
spring-boot-start er-swagger |
||
wechat_info_colle ct |
||
Janus | ||
phpvuln | ||
findomain | ||
IIS_exploit | ||
shadowsocks | ||
ecapture | ||
JSPHorse | ||
DVWA | ||
aSYNcrone | ||
capa | ||
Fofa-collect | ||
clash_for_windows _pkg |
||
bluescan | ||
CVE-2018-14729 | ||
EyeWitness | ||
RsaCtfTool | ||
awvs-decode | ||
Windows-Exploit-S uggester |
||
YourNextBugTip | ||
pdf-export | ||
hackingthe | ||
USB-Rubber-Ducky | ||
CobaltSpam | ||
hackbar2 | ||
dc_find | ||
masnmapscan-V1 | ||
nanodump | ||
BaiLu-SED-Tool | ||
Thanos | ||
password_brute_di ctionary |
||
CVE-2017-12615 | ||
S2-045 | ||
S2-055 | ||
S2-056-XStream | ||
xss-payload-list | ||
httpie | ||
WOTD | ||
CVE-2020-8840 | ||
Grafana-VulnTips | ||
ncDecode | ||
webuploader-0 | ||
dnscrypt-proxy | ||
jsonhero-web | ||
bro-pdns | ||
Axis-1 | ||
2020-Interview-ex perience |
||
CVE-2021-1727 | ||
InstallerFileTake Over |
||
ProfSvcLPE | ||
LangNetworkTopolo gy3 |
||
DFA | ||
libssh-scanner | ||
mscan | ||
dedecmscan | ||
ddos-tools | ||
slowloris | ||
iCULeak | ||
cryptovenom | ||
2017-Security-ppt | ||
subzy | ||
SharpCookieMonste r |
||
Middleware-Vulner ability-detection |
||
WXDBDecrypt | ||
BurpSuiteSuite-co llections |
||
hackbar2 | ||
linux-exploit-sug gester |
||
idcard | ||
EggShell | ||
SeeyonEXP | ||
PowerDNS-Admin | ||
Cas_Exploit | ||
1earn | ||
AboutSecurity | ||
CVE-2021-41653 | ||
CVE-2020-0601 | ||
SMBGhost | ||
qqwry | ||
chineseocr_lite | ||
Amass | ||
CVE-2022-21907-ht tp |
||
RDWArecon | ||
Ruoyi-All | ||
PeiQi-WIKI-POC | ||
awesome-pentest-n ote |
||
conote-community | ||
CVE-2021-21985 | ||
CVE-2021-22005 | ||
CVE-2021-29200 | ||
CVE-2021-30128 | ||
Benchmarks | ||
Hacking-With-Gola ng |
||
joomscan | ||
cs-ssl-gen | ||
hideNsneak | ||
oh-my-zsh | ||
exp | ||
hashtopolis | ||
MITM-cheatsheet | ||
impacket | ||
DumpTheGit | ||
jumpserver_rce | ||
Fuzz_dic | ||
wechat-export | ||
2022-HW-POC | ||
csirt | ||
poshkatz | ||
CVE-2019-2890 | ||
VPS-web-hacking-t ools |
||
suricata-rules | ||
metinfo_sqlinject ion |
||
TPScan | ||
microsoftSpider | ||
Struts2_045-Poc | ||
awvs13_batch_py3 | ||
blackeye | ||
VTSCAN | ||
prowler | ||
Bug-Hunting-Domai ns |
||
CSAgent | ||
repo-security-sca nner |
||
CVE-2018-8120 | ||
CVE-2022-2639-Pip eVersion |
||
CVE-2018-3191 | ||
wappalyzer | ||
Kage | ||
sam-the-admin | ||
Whonix | ||
woodpecker-framwo rk-release |
||
fastjson_rce_tool | ||
shiro_rce | ||
gojwtcrack | ||
STS2G | ||
chrome_password_g rabber |
||
wxappUnpacker | ||
xxx | ||
clashX | ||
yougar0 | ||
seeyou_exp | ||
CVE-2019-0708 | ||
SiteServer-CMS-Re mote-download-Gets hell |
||
zhuqingcode | ||
Joker | ||
gitleaks | ||
RSA |
项目名称 | 版本 | 项目描述 |
---|---|---|
locust | 2.20.0 | Write scalable load tests in plain Python 🚗💨 |
项目名称 | 版本 | 项目描述 |
---|---|---|
SSRF_Vulnerable_L ab |
This Lab contain the sample codes which are vulnerable to Serv er-Side Request Forgery attack |
|
https://dvwa.co.uk/ | ||
DoraBox | DoraBox - Basic Web Vulnerability Training | |
WackoPicko | WackoPicko is a vulnerable web application used to test web ap plication vulnerability scanners. |
|
xssed | A set of XSS vulnerable PHP scripts for testing | |
sqli-labs | SQLI labs to test error based, Blind boolean based, Time based . |
|
BWVS | Web漏洞渗透测试靶场 | |
upload-labs | 0.1 | 一个想帮你总结所有类型的上传漏洞的靶场 |
vulstudy | 使用docker快速搭建各大漏洞靶场,目前可以一键搭建17个靶场。 | |
xxe-lab | 一个包含php,java,python,C#等各种语言版本的XXE漏洞Demo | |
vulnerable-node | A very vulnerable web site written in NodeJS with the purpose of have a project with identified vulnerabilities to test the q uality of security analyzers tools tools |
|
vulfocus | v0.3.2. 11 |
🚀Vulfocus 是一个漏洞集成平台,将漏洞环境 docker 镜像,放入即 可使用,开箱即用。 |
hackademic | the main hackademic code repository | |
Hello-Java-Sec | 1.10 | ☕️ Java Security,安全编码和代码审计 |
SpringBootVulExpl oit |
SpringBoot 相关漏洞学习资料,利用方法和技巧合集,黑盒安全评估 check list |
|
ElectricRat | v1.3.0 | 电气鼠靶场系统是一种带有漏洞的Web应用程序,旨在为Web安全渗透测 试学习者提供学习和实践的机会。The Electrical Mouse Target Range System is a web application with vulnerabilities designed to pr ovide learning and practice opport |
VulApps | 快速搭建各种漏洞环境(Various vulnerability environment) | |
bodgeit | 1.4.0 | The BodgeIt Store is a vulnerable web application which is cur rently aimed at people who are new to pen testing. |
MCIR | The Magical Code Injection Rainbow! MCIR is a framework for bu ilding configurable vulnerability testbeds. MCIR is also a coll ection of configurable vulnerability testbeds. |
|
DSVW | Damn Small Vulnerable Web | |
SecExample | JAVA 漏洞靶场 (Vulnerability Environment For Java) | |
vulhub | Pre-Built Vulnerable Environments Based on Docker-Compose | |
webug4.0 | webug4.0 | |
WebGoat | v2023.8 | WebGoat is a deliberately insecure application |
pikachu | 一个好玩的Web安全-漏洞测试平台 | |
https://hackmyvm.eu/anon/ | ||
https://www.pentesterlab.com/exercises/web_for_pentester/course |
项目名称 | 版本 | 项目描述 |
---|---|---|
camille | 基于Frida的Android App隐私合规检测辅助工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Awesome-ChatGPT | ChatGPT资料汇总学习,持续更新...... | |
chatgpt | ChatGPT网址导航,分享免费好用AI网站! | |
ChatGPT-Shortcut | 🚀💪Maximize your efficiency and productivity, support for Eng lish,中文,Español,العربية. 让生产力加倍的AI快捷指令。更有效地定 制、保存和分享自己的提示词。在提示词分享社区中,轻松找到适用于不 同场景的指令。 |
|
chatgpt-mac | v0.0.5 | ChatGPT for Mac, living in your menubar. |
awesome-chatgpt-z h |
ChatGPT 中文指南🔥,ChatGPT 中文调教指南,指令指南,应用开发指 南,精选资源清单,更好的使用 chatGPT 让你的生产力 up up up! 🚀 |
项目名称 | 版本 | 项目描述 |
---|---|---|
FastGithub | 2.1.4 | github加速神器,解决github打不开、用户头像无法加载、releases无 法上传下载、git-clone、git-pull、git-push失败等问题 |
项目名称 | 版本 | 项目描述 |
---|---|---|
MySQLMonitor | 1.0 | MySQL实时监控工具(代码审计/黑盒/白盒审计辅助工具) |
项目名称 | 版本 | 项目描述 |
---|---|---|
pppoe-intercept | v0.3 | 用来模拟中间人拦截 pppoe 拨号过程的账号密码 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Python-100-Days | Python - 100天从新手到大师 |
项目名称 | 版本 | 项目描述 |
---|---|---|
HackerMind | 各种安全相关思维导图整理收集。渗透步骤,web安全,CTF,业务安全 ,人工智能,区块链安全,数据安全,安全开发,无线安全,社会工程学 ,二进制安全,移动安全,红蓝对抗,运维安全,风控安全,linux安全 |
项目名称 | 版本 | 项目描述 |
---|---|---|
KeymouseGo | v5.1.1 | 类似按键精灵的鼠标键盘录制和自动化操作 模拟点击和键入 |
项目名称 | 版本 | 项目描述 |
---|---|---|
HackReport | 渗透测试报告/资料文档/渗透经验文档/安全书籍 |
项目名称 | 版本 | 项目描述 |
---|---|---|
rotp | v6.3.0 | Ruby One Time Password library |
项目名称 | 版本 | 项目描述 |
---|---|---|
SMSBoom | main | 短信轰炸/短信测压/ |
项目名称 | 版本 | 项目描述 |
---|---|---|
SmsForwarder | v3.2.0 | 短信转发器——监控Android手机短信、来电、APP通知,并根据指定规 则转发到其他手机:钉钉群自定义机器人、钉钉企业内机器人、企业微信 群机器人、飞书机器人、企业微信应用消息、邮箱、bark、webhook、Tel egram机器人、Server酱、PushPlus、手机短信等。包括主动控制服务端 与客户端,让你轻松远程发短信、查短信、查通话、查话簿、查电量等。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
flightsim | v2.5.0 | A utility to safely generate malicious network traffic pattern s and evaluate controls. |
项目名称 | 版本 | 项目描述 |
---|---|---|
Augmentor | Image augmentation library in Python for machine learning. | |
dddd_trainer | ddddocr训练工具 |
项目名称 | 版本 | 项目描述 |
---|---|---|
v2rayfree | v2ray节点、免费节点、免费v2ray节点、最新公益免费v2ray节点订阅 地址、免费v2ray节点每日更新、免费ss/v2ray/trojan节点、freefq |
|
free | 翻墙、免费翻墙、免费科学上网、免费节点、免费梯子、免费ss/v2ray /trojan节点、蓝灯、谷歌商店、翻墙梯子 |
|
v2rayA | v2.2.4. 3 |
A web GUI client of Project V which supports VMess, VLESS, SS, SSR, Trojan, Tuic and Juicity protocols. 🚀 |
项目名称 | 版本 | 项目描述 |
---|---|---|
MockingBird | v0.0.1 | 🚀AI拟声: 5秒内克隆您的声音并生成任意语音内容 Clone a voice in 5 seconds to generate arbitrary speech in real-time |
项目名称 | 版本 | 项目描述 |
---|---|---|
zksync-auto | some help for zksync incentive | |
zksync | ||
all-in-one-v2 | ||
zksync2-python | v0.6.0 |
项目名称 | 版本 | 项目描述 |
---|---|---|
BugRepoter_0x727 | BugRepoter_0x727(自动化编写报告平台)根据安全团队定制化协同管理 项目安全,可快速查找历史漏洞,批量导出报告。 |
|
SAReport | 渗透测试自动化报告平台 | |
APTRS | Automated Penetration Testing Reporting System | |
report | v1.0.1 | 乙方渗透测试漏洞报告管理系统 |
pentest_report | v1.0.0 | A pentest reporter generator |
WaterExp | WaterExp:面向安服仔的 水报告模板和工具 | |
Savior | new | 渗透测试报告自动生成工具! |
项目名称 | 版本 | 项目描述 |
---|---|---|
faker | v21.0.0 | Faker is a Python package that generates fake data for you. |
项目名称 | 版本 | 项目描述 |
---|---|---|
dbeaver | 23.3.0 | Free universal database tool and SQL client |
项目名称 | 版本 | 项目描述 |
---|---|---|
dperf | v1.6.0 | dperf is a 100Gbps network load tester. |
WebBench | Webbench是Radim Kolar在1997年写的一个在linux下使用的非常简单的 网站压测工具。它使用fork()模拟多个客户端同时访问我们设定的URL, 测试网站在压力下工作的性能,最多可以模拟3万个并发连接去测试网站 的负载能力。官网地址:http://home.tiscali.cz/~cz210552/webbench.h tml |
项目名称 | 版本 | 项目描述 |
---|---|---|
Umi-OCR | release /2.0.1 |
OCR software, free and offline. 开源、免费的离线OCR软件。支持 截屏/粘贴/批量导入图片,段落排版/排除水印,扫描/生成二维码。内置 多国语言库。 |
项目名称 | 版本 | 项目描述 |
---|---|---|
Calculate_Captcha | v1.1 | 计算验证码生成器,用于训练使用 |
项目名称 | 版本 | 项目描述 |
---|---|---|
FreeRDP | 2.11.4 | FreeRDP is a free remote desktop protocol library and clients |
Quasar | v1.4.1 | Remote Administration Tool for Windows |
rustdesk | 1.2.3 | An open-source remote desktop, and alternative to TeamViewer. |