更新于 2023-12-15 08:36:20

近15天release更新记录

更新时间	项目名称	版本	更新内容
2023-12-14 18:08:32	FreeRDP	2.11.4	Notworthy changes: * fix a typo in un icode commit (#9652)
2023-12-14 13:04:05	frp	v0.53.0	### Features * The new command line p arameter --strict_config has been adde d to enable strict configuration valid ation mode. It will throw an error for unknown fields instead of ig
2023-12-14 12:42:12	Pillager	AutoBui ld
2023-12-14 08:33:38	PyWxDump	v2.3.11	[Auto Release] Update PyWxDump to ref s/tags/v2.3.11
2023-12-13 16:59:53	faker	v21.0.0	See .
2023-12-13 14:49:19	WeChatMsg	v0.2.8	# 新增功能 * 支持导出语音 #76 * 支持导出引用消息 * 新增导出到txt文档 * 新增自主选择导出类型 # 优化 * 移除对模拟器数据库的支持 * 修复图片或视频显示不全的问题 #126 * html页面输入页码可以回车跳转，跳转后自动滚动到页面顶部。#114 * 联系人按照最新聊天时间排序 #122 * 年度报告词云图按照发送和接收分别处理 #
2023-12-13 12:32:04	locust	2.20.0	## What's Changed * Unable to modify custom parameters from the modern UI b y @andrewbaldwin44 in https://github.c om/locustio/locust/pull/2491 * Further relax FastHttpUser's host ch
2023-12-13 05:17:50	goproxy	v14.1	1、sps/socks新增--udp-compat参数，用于打开socks5 udp功能的兼容模式，兼容某些不遵守socks5 RFC 1928 规范的socks5客户端。 2、sps/socks新增--udp-gc参数，用来设置UDP最大空闲时间，超过这个时间，UD P会被释放。
2023-12-13 00:42:41	CTFd	3.6.1	# 3.6.1 / 2023-12-12 Security - F ix an issue where users could bypass S core Visibility and see a user's score /place when not allowed by Admins Ge neral - Add Slovak, Japanes
2023-12-12 21:08:39	dbeaver	23.3.0	Changes since 23.2.5: - Security: da tabase drivers were updated due to sec urity reasons: DB2, Google BigQuery, A thena, and YugabyteDB - SQL Editor: - Autocompletion of column name
2023-12-11 16:47:07	codeql-cli-binari es	v2.15.4	### Improvements - Parallelism in the evaluator has been improved, resultin g in faster analysis when running with many threads, particularly for large databases. For more informati
2023-12-11 06:31:19	ImageMagick	7.1.1-2 3	## What's Changed * configure.ac: Fix bashism by @thesamesam in https://git hub.com/ImageMagick/ImageMagick/pull/6 931 * Fix zstd not being listed under GetMagickDelegates() by @valg
2023-12-10 04:25:47	PEASS-ng	2023121 0-89d560 ba
2023-12-09 13:37:47	Online_tools	0.5.0	### 增加新工具 - yakit - SBSCAN ### 更新了什么这个版本更新很多功能，下面我就说一下改动比较大的一些功能 - 自定义工具添加 - 改成了点击图标启动工具，下载工具，更新工具 - 添加自定义界面的设置 - 全局快捷键工具的搜索，可以按alt+d键快速弹出 - 下载卸载更新添加自动刷新界面 - 代码的运行优化
2023-12-09 13:25:37	nuclei	v3.1.1	## What's Changed * Added support fo r arbitrary string input for TLS SNI a nnotation by @jimen0 in https://github .com/projectdiscovery/nuclei/pull/4462 * Fixed panic + refactor hea
2023-12-09 03:45:36	gshark	v1.4.0	## Fixed * go-github 组件升级 * GitHu b 扫描支持系统代理
2023-12-08 23:48:02	containerd	v1.7.11	Welcome to the v1.7.11 release of con tainerd! The eleventh patch release fo r containerd 1.7 contains various fixe s and updates including one security i ssue. ### Notable Updates * *
2023-12-08 12:51:55	Umi-OCR	release /2.0.1	### v2.0.1 ŠŤ┤Šľ░ňćůň«╣´╝Ü - ŃÇ ÉHTTPŠÄąňĆúšöĘŠłĚŠ│ĘŠäĆŃÇĹ ÚçŹŠľ░Ŕ «żŔ«íń║ćHTTPŠÄąňĆúŃÇéňůüŔ«ŞšťüšĽąňĆéŠ Ľ░´╝îňůüŔ«ŞŔ«żň«ÜŠ«ÁŔÉŻňÉłň╣ÂŃÇéŔžü ŃÇé - ňĹŻń╗ĄŔíîňó×ňŐáŠîçń╗Ą-->ňĺî--> >´╝
2023-12-08 12:29:28	rengine	v2.0.2	## What's Changed * Added tooltip tex t to dashboard total vulnerabilities t ooltip by @luizmlo in https://github.c om/yogeshojha/rengine/pull/1029 * ops( uninstall.sh): add missing vo
2023-12-08 10:59:45	mitaka	v1.4.1	## What's Changed * chore(deps): upda te actions/setup-node action to v4 by @renovate in https://github.com/ninose ki/mitaka/pull/780 * v6.0.1 by @ninose ki in https://github.com/nino
2023-12-08 03:47:17	safeline	v3.15.3	### 修复 - 修复 403 拦截页面没有展示拦截页面附加说明的问题
2023-12-07 11:44:20	TranSec	transec os1.0	tranOS is iso tranOS_OVA is ova The t xt file contains hash values for iso a nd ova
2023-12-06 03:30:59	afrog	v2.9.5	【新增】-cyberspace / -cs 网络测绘空间搜索功能，支持 ZoomEye，命令实例：-cs zoomeye -q "app:'Yonyou NC httpd'" -q c 200 详情见 wiki 【优化】PoC GitLab p ublic snippets 漏洞等级由 INFO 改为 HI GH -------------------------
2023-12-05 10:23:50	WebGoat	v2023.8	## Version v2023.8 ### 🚀 New functio nality - Consistent environment values and url references (#1677) - Show dir ectly requested file in requests overv iew - Show creating time in fi
2023-12-05 09:21:33	trivy	v0.48.0	## ⚡Release highlights and summary⚡ 👉 https://github.com/aquasecurity/tr ivy/discussions/5724 ## Changelog * f2 aa9bf3e chore(deps): bump sigstore/cos ign-installer from 4a861528be5e6
2023-12-04 15:00:34	ysomap	v0.1.5	- fix shiro exploit @BBQM1911 #54 v0. 1.5 2023.12.04 auto-generated by githu b actions
2023-12-03 18:20:26	pyinstxtractor	2023.12	Bump release version
2023-12-03 09:23:20	Ladon	v12.0	Ladon 12.0 20231201 [+]DomainLog Doma inUserIP 远程查询域用户、IP [u]LoginL og 4624成功日志域用户、域名、登陆IP / all 导出全部日志原始数据 LoginLog 用户名 LoginLog 用户名记录数
2023-12-03 06:18:42	Viper	2023-12 -03-13-4 4-27	### Bugfix - Fix https://github.com/F unnyWolf/Viper/issues/188 - Fix https: //github.com/FunnyWolf/Viper/issues/18 7 - Fix https://github.com/FunnyWolf/V iper/issues/186
2023-11-30 14:40:51	grype	v0.73.4	### Additional Changes - bump to syft v0.98.0 in quality gate tests @westo nsteimel] - update syft to v0.98.0; go mod tidy @spiffcs] ****

近15天commit提交记录

提交时间	项目名称	更新内容
2023-12-15 00:31:19	PoC-in-GitHub	Auto Update 2023/12/15 00:31:19
2023-12-15 00:30:28	sliver	Merge pull request #1506 from BishopFox/docs/next F ix dark mode docs
2023-12-15 00:00:02	free	updated_at 12-15 08:00
2023-12-14 23:13:15	CTFd	Merge pull request #2442 from CTFd/update-core-beta * Update core-beta to latest version * Include meta tag & title customization * Fix issue with private user pages in teams mode
2023-12-14 22:18:37	syft	chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.2 to 0.8.0 (#2413)
2023-12-14 22:00:59	WebGoat	Fix typos in texts.
2023-12-14 21:44:41	PocOrExp_in_Githu b	update 2023-12-15 05:44:41
2023-12-14 20:30:02	logging-log4j2	Javadoc
2023-12-14 19:59:30	ImHex	fix: Format security error
2023-12-14 19:58:50	john	autotools: stop linking against the OpenCL library Start using dynamic OpenCL binding. And continue bui lding a non-OpenCL binary for users who don't have O penCL installed. Signed-o
2023-12-14 18:59:28	neuvector	Merge pull request #1128 from williamlin-suse/main NVSHAS-8247: Less cross-check when processing CRD (i ncrease the chann…
2023-12-14 18:08:41	metasploit-framew ork	Bump version of framework to 6.3.48
2023-12-14 16:35:59	dbeaver	Merge branch 'devel' of https://github.com/dbeaver/ dbeaver into devel
2023-12-14 16:29:09	PST-Bucket	goby: Update to version 2.8.5
2023-12-14 15:33:04	WeChatMsg	修改部分ui
2023-12-14 14:56:55	containerd	Merge pull request #9514 from containerd/dependabot /github_actions/actions/upload-artifact-3 build(deps ): bump actions/upload-artifact from 1 to 3
2023-12-14 14:31:01	PyWxDump	添加简单教程
2023-12-14 13:17:39	v2rayA	debian: add loong64 and remove ppc64el armv7/8
2023-12-14 13:05:39	FreeRDP	[proxy,modules] explicitly build shared libraries T he proxy modules must always be shared libraries. To have the proper system extension, use keyword SHARE D instead of MOUDLE
2023-12-14 12:54:03	frp	update doc (#3844)
2023-12-14 12:40:57	Pillager	Update README.md
2023-12-14 12:36:40	v2rayfree	update
2023-12-14 11:53:49	sqlmap	Minor update
2023-12-14 11:10:49	volatility3	Merge pull request #1057 from eve-mem/linux_fix_pst ree Linux: Update pslist to fix pstree
2023-12-14 09:52:08	Umi-OCR	预备：PDF识别
2023-12-14 09:21:48	Library-POC	Update README.md
2023-12-14 08:45:46	afrog	update
2023-12-14 08:21:09	murphysec	ci(gitlab): Remove unused ci image
2023-12-14 07:50:42	HackerPermKeeper	Update README.md
2023-12-14 07:48:20	DIE-engine	Update module: XDataConvertorWidget 2023-12-14
2023-12-14 07:32:01	appshark	Merge pull request #64 from firmianay/dev3 add runt imeSDK
2023-12-14 07:29:24	All-Defense-Tool	更新v3.1
2023-12-14 02:43:58	safeline	feat: update 5xx page
2023-12-14 01:04:32	rustdesk	New term added (#6673) * Update es.rs New terms add ed * Update es.rs mistype correction * Update es.rs New term added
2023-12-14 00:55:11	ImageMagick	check for corrupt DJVU images (https://github.com/I mageMagick/ImageMagick/security/advisories/GHSA-wv9p -78jx-g7fv)
2023-12-13 22:50:11	grype	chore(deps): bump github.com/charmbracelet/bubblete a (#1635) Bumps from 0.24.2 to 0.25.0. - - --- up dated-dependencies: - dependency-name: github.com/ch armbracelet/bubbletea dep
2023-12-13 18:33:26	anti-AD	Auto renew the anti-AD list.
2023-12-13 16:59:25	faker	Bump version: 20.1.0 → 21.0.0
2023-12-13 14:29:08	iDefender	update
2023-12-13 12:35:23	locust	update autogenerated changelog
2023-12-13 12:07:31	trivy	refactor(purl): use pub from package-url (#5784)
2023-12-13 11:37:30	audacity	disable FLAC export when no tracks are present... . .. and remove the hiddenfilemenu containing a duplic ate entry.
2023-12-13 09:23:41	gshark	Merge pull request #188 from madneal/dependabot/go_ modules/server/github.com/mojocn/base64Captcha-1.3.6 Bump github.com/mojocn/base64Captcha from 1.3.1 to 1.3.6 in /server
2023-12-13 07:28:12	kube-bench	build(deps): bump golang from 1.21.3 to 1.21.5 (#15 34) Bumps golang from 1.21.3 to 1.21.5. --- updated- dependencies: - dependency-name: golang dependency-t ype: direct:production up
2023-12-13 07:14:03	ChatGPT-Shortcut	perf(comment): optimize logic and performance in th e comment component
2023-12-12 23:55:31	MemProcFS	Version 5.8.19
2023-12-12 15:45:35	clair	cmd: annotate fake key for gitleaks This file appar ently has CRLF line endings, and I don't recall why. Odd. Signed-off-by: Hank Donnay
2023-12-12 11:32:16	all-in-one-v2	fix await
2023-12-12 07:28:48	nemo_go	Update: 优化指纹任务
2023-12-12 05:42:04	SmsForwarder	新增：自动任务·快捷指令 —— 通道推送动作（开发中）
2023-12-12 05:11:14	vulnerability	CVE-2023-6655
2023-12-12 03:03:35	Vulhub-Reproduce	更新漏洞
2023-12-12 03:02:26	Vulnerability-Wik i	更新漏洞
2023-12-11 16:43:38	codeql-cli-binari es	Update changelog for 2.15.4
2023-12-11 15:00:07	subfinder	Merge pull request #1076 from projectdiscovery/depe ndabot/go_modules/v2/dev/github.com/projectdiscovery /retryablehttp-go-1.0.39
2023-12-11 08:09:44	Mobile-Security-F ramework-MobSF	update pktool to 2.9.1 (#2304)
2023-12-11 08:08:48	Awesome-Redteam	update info gathering
2023-12-11 07:06:12	nuclei	Merge pull request #4481 from projectdiscovery/depe ndabot/go_modules/dev/github.com/projectdiscovery/fa stdialer-0.0.48
2023-12-11 02:48:11	404StarLink	weekly update at 2023-12-11
2023-12-11 01:27:56	FrameVul	Update README.md
2023-12-10 07:08:12	ctf-archives	0CTF chals
2023-12-10 00:50:46	ThinkAdmin	修改 Excel.js 数据导出参数
2023-12-09 15:00:53	Online_tools	0.5.0公测版
2023-12-08 12:20:21	rengine	Merge pull request #1086 from yogeshojha/fixes-for- tool-arsenal fix(tool_arsenal): incorrect regex vers ion numbers
2023-12-08 10:58:41	mitaka	v1.4.1
2023-12-08 09:52:54	Elkeid	FIXME: possible crash due to resched triggered by p ut_files_struct() When parent process is exiting, th e last put_files_struct() would try to drop all file s which triggers a resche
2023-12-08 07:39:47	Viper	update version 2023-12-07
2023-12-08 01:55:29	TranSec	Update README.md
2023-12-07 17:16:36	vulhub	Merge pull request #477 from vulhub/ofbiz-cve-2023- 49070
2023-12-07 15:12:25	awesome-chatgpt-z h	add intel-extension-for-transformers
2023-12-07 14:34:05	FingerprintHub	Auto Update FingerPrint [Thu Dec 7 14:34:05 UTC 202 3] 🤖
2023-12-07 14:13:43	HKEcho_Nacos	Update README.md
2023-12-07 02:33:06	Scanners-Box	YOU can donate with Buy me a coffee now
2023-12-06 07:45:48	jdwp-codeifier	修改README
2023-12-06 04:46:58	beef	Merge branch 'dependabot/bundler/rdoc-6.6.1'
2023-12-05 19:05:45	RsaCtfTool	update dixon.py
2023-12-04 15:39:00	ThunderSearch	fix zoomeye host_search
2023-12-04 14:55:41	ysomap	update version
2023-12-04 12:47:40	HFish	Update webinstall.sh
2023-12-04 07:10:47	HackerMind	Update 2.0 version:peach:
2023-12-04 03:25:31	arthas	fix typo (#2746)
2023-12-04 01:13:57	ObserverWard	Merge pull request #214 from 0x727/dependabot/cargo /serde-1.0.193 Bump serde from 1.0.190 to 1.0.193
2023-12-03 18:19:07	pyinstxtractor	Mention support for 6.1.0, 6.2.0
2023-12-03 12:36:45	dirsearch	Fixing Dockerfile python version
2023-12-03 09:17:35	Ladon	Add files via upload
2023-12-03 09:13:43	K8tools	Add files via upload
2023-12-01 17:44:24	wpscan	Merge pull request #1820 from wpscanteam/dfs Update s DFs
2023-11-30 12:31:13	Komo	Update requirement.txt
2023-11-30 09:43:04	Awesome-POC	更新漏洞
2023-11-30 08:31:33	VolatilityPro	Update README.md
2023-11-30 03:59:12	jar-analyzer-gui	Update README.md

安全

CTF

AWD

靶场

项目名称	版本	项目描述
wordpress		AWD靶机
AWDDocker		标准化AWD靶场Docker
20190511_awd_dock er		2019 年 5 月 11 日防灾科技学院 “应急挑战杯” 大学生网络安全邀请赛 AWD 靶机题目。
AWD_CTF_Platform		一个简单的AWD训练平台
Liaoning-provinci al-competition-tar get-1		第三届辽宁省ctf线下awd靶机1web
awd-platform		platform for awd

防护

项目名称	版本	项目描述
AoiAWD		AoiAWD-专为比赛设计，便携性好，低权限运行的EDR系统。
k4l0ng_WAF		A broute detect WAF by PHP using to AWD
CTF-WAF		针对CTF线下赛的通用WAF，日志审计功能。

脚本

项目名称	版本	项目描述
Prepare-for-AWD		AWD攻防赛脚本集合
AWD-Predator-Fram ework		AWD攻防赛webshell批量利用框架
awd_attack_framew ork		awd攻防常用脚本+不死马+crontab+防御方法

开源平台

项目名称	版本	项目描述
JJUCTF_V2.0		JJU网络安全靶场实训平台
H1ve	1.1.3	An Easy / Quick / Cheap Integrated Platform
Cardinal	v0.7.3	CTF🚩 AWD (Attack with Defense) 线下赛平台 / AWD platform - 欢迎 Star~ ✨
CTF_AWD_Platform		CTF 攻防对抗平台
GZCTF	v0.17.6	The GZ::CTF project, an open source CTF platform.
MarsCTF	V1.2.1	Vue+Springboot开发的CTF学习平台，提供动态靶机、学习模块、write up模块等等CTF平台的核心功能。提供docker版本

Crypto

古典密码

autokey

项目名称	版本	项目描述
breakautokey		breakautokey

现代密码

RSA

项目名称	版本	项目描述
CTF-RSA-tool		a little tool help CTFer solve RSA problem
RSA
rsa-wiener-attack		A Python implementation of the Wiener attack on RSA public-key encryption scheme.
RsaCtfTool		RSA attack tool (mainly for ctf) - retrieve private key from w eak public key and/or uncipher data

Misc

16进制编辑

项目名称	版本	项目描述
ImHex	v1.31.0	🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

编码解码

项目名称	版本	项目描述
CTFCrackTools	4.0.7	China's first CTFTools framework.**国内首个CTF工具框架,旨在帮助CTFer快速攻克难关
Ciphey	5.14.0	⚡ Automatically decrypt encryptions without knowing the key o r cipher, decode encodings, and crack hashes ⚡
CyberChef	v10.5.2	The Cyber Swiss Army Knife - a web app for encryption, encodin g, compression and data analysis
TomatoTools	v1.0.2	TomatoTools 一款CTF杂项利器，支持36种常见编码和密码算法的加密和解密，31种密文的分析和识别，支持自动提取flag，自定义插件等。

二维码批量识别

项目名称	版本	项目描述
QrScan	v2.9.0	离线批量检测图片是否包含二维码以及识别二维码

自动拼图

项目名称	版本	项目描述
PuzzleSolver	v1.0.1- beta	一款专门为CTF比赛设计的拼图工具

综合

项目名称	版本	项目描述
CTF_Hacker-Tools
qsnctf-python	0.0.8.1 0	青少年CTF的Python包，方便大家调用一些CTF常用功能。
CTF-Tools	v1.3.7	一款Python+Pyqt写的CTF编码、解码、加密、解密工具。

Pwn

项目名称	版本	项目描述

Reverse

Java反编译

项目名称	版本	项目描述
JavaDecompileTool -GUI	V1.2	Java Decompile Tool GUI-JAVA反编译工具（界面版）
CodeReviewTools	v1.31	通过正则搜索、批量反编译特定Jar包中的class名称

pyc逆向

项目名称	版本	项目描述
stegosaurus	1.0	A steganography tool for embedding payloads within Python byte code.
python-uncompyle6	3.9.0	A cross-version Python bytecode decompiler
pyinstxtractor	2023.12	PyInstaller Extractor

查壳

项目名称	版本	项目描述
DIE-engine	3.08	DIE engine

Web

定向目录扫描

项目名称	版本	项目描述
ctf-wscan		在kingkaki的项目上进行了修改，改为单线程，可以在任意目录下执行，对重复的请求进行了过滤

项目名称	版本	项目描述
		http://www.ctftools.com/
apachecn-ctf-wiki
CTFd	3.6.1	CTFs as you need them
ctf-tools		CTF 工具集合
BerylEnigma	1.15.0	ffffffff0x team toolset for penetration testing, cryptography research, CTF and daily use.
CTFd_chinese_CN	v1.2.0	对CTFd平台各版本的汉化记录。key:中文、汉化、翻译、chinese、CN 、CTFd
CTF-Note		CTF笔记：该项目主要记录CTF知识、刷题记录、工具等。
ctf_ics_traffic		工控CTF比赛工具，各种网络数据包处理脚本
CTF-QuickStart		源仓库存档
CTFtools-wiki		【Hello CTF】录常用 / 优秀的CTF工具项目及其文档,一个对各阶段C TFer都很友好的工具仓库,让所有的工具都发挥作用！
SecToolKit		Cybersecurity tool repository / Wiki 收录常用 / 前沿的CTF和渗透工具以及其官方/使用文档，致力于让每个工具都能发挥作用ww，不管你是萌新还是领域从业者希望你都能在这里找到适合你的工具或者获得一定的启发。
CTF-Tools		渊龙Sec安全团队CTF&AWD工具箱
ctf-archives		CTF Archives: Collection of CTF Challenges.

红队

Web安全

漏洞发现库

安卓漏洞扫描

项目名称	版本	项目描述
appshark	v0.1.2	Appshark is a static taint analysis platform to scan vulnerabi lities in an Android app.

安卓抓包辅助

项目名称	版本	项目描述
r0capture		安卓应用层抓包通杀脚本

半自动漏洞扫描

项目名称	版本	项目描述
myscan		myscan 被动扫描
DarkAngel/
xray	1.9.11	一款完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc
Fvuln	Fvuln-1 .4.9	F-vuln（全称：Find-Vulnerability）是为了自己工作方便专门编写的一款自动化工具，主要适用于日常安全服务、渗透测试人员和RedTeam红队人员，它集合的功能包括：存活IP探测、开放端口探测、web服务探测、web漏洞扫描、smb爆破、ssh爆破、ftp爆破、mssql爆破等其他数据库爆破工作以及大量web漏洞检测模块。
EasyPen		EasyPen is a GUI program which helps pentesters do target disc overy, vulnerability scan and exploitation
nuclei	v3.1.1	Fast and customizable vulnerability scanner based on simple YA ML based DSL.
QingTing	v0.3	蜻蜓安全一个安全工具编排平台,可以自由编排你的工具流,集成108款工具,包括xray、nmap、awvs等;你可以将喜欢的工具编排成一个场景，快速打造适合自己的安全工作台~
NextScan	v1.2.0	飞刃是一套完整的企业级黑盒漏洞扫描系统，集成漏洞扫描、漏洞管理、扫描资产、爬虫等服务。拥有强大的漏洞检测引擎和丰富的插件库，覆盖多种漏洞类型和应用程序框架。
POC-bomber	POC-bom ber-for- Redteam- v3.0.0	利用大量高威胁poc/exp快速获取目标权限，用于渗透和红队快速打点
w13scan		Passive Security Scanner (被动式安全扫描器)
afrog	v2.9.5	A Security Tool for Bug Bounty, Pentest and Red Teaming.
vulmap	v0.9	Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞验证功能

代码审计

java

项目名称	版本	项目描述
code-inspector	0.2-bet a	JavaWeb漏洞审计工具，构建方法调用链并模拟栈帧进行分析
jar-analyzer-gui	1.1	建议使用新版：https://github.com/jar-analyzer/jar-analyzer
codeql-cli-binari es	v2.15.4	Binaries for the CodeQL CLI
CodeQLpy		CodeQLpy是一款基于CodeQL实现的半自动化代码审计工具，目前仅支持 java语言。实现从源码反编译，数据库生成，脆弱性发现的全过程，可以辅助代码审计人员快速定位源码可能存在的漏洞。
JVWA		java 代码审计学习靶场

other

项目名称	版本	项目描述
Kunlun-M	v2.6.5	KunLun-M是一个完全开源的静态白盒扫描工具，支持PHP、JavaScript 的语义扫描，基础安全、组件安全扫描，Chrome Ext\Solidity的基础扫描。
murphysec	v3.1.1	An open source tool focused on software supply chain security. 墨菲安全专注于软件供应链安全，具备专业的软件成分分析（SCA）、漏洞检测、专业漏洞库。
fortify		fortify内置规则加密破解

python

项目名称	版本	项目描述
python_code_audit		python 代码审计项目
python_sec		python安全和代码审计相关资料收集 resource collection of python security and code review

口令爆破

项目名称	版本	项目描述
web-brutator		Fast Modular Web Interfaces Bruteforcer
thc-hydra-windows	v9.1	The great THC-HYDRA tool compiled for Windows
ssb	v0.1.1	Secure Shell Bruteforcer — A faster & simpler way to brutefor ce SSH server
SNETCracker	1.0.201 90715	超级弱口令检查工具是一款Windows平台的弱口令审计工具，支持批量多线程检查，可快速发现弱密码、弱口令账号，密码支持和用户名结合进行检查，大大提高成功率，支持自定义服务端口和字典。
WebCrack		WebCrack是一款web后台弱口令/万能密码批量检测工具，在工具中导入后台地址即可进行自动化检测。
john		John the Ripper jumbo - advanced offline password cracker, whi ch supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
thc-hydra	v9.5	hydra

漏洞发现

项目名称	版本	项目描述
Ingram	v2.0.0	网络摄像头漏洞扫描工具
Dude

漏洞扫描框架

项目名称	版本	项目描述
Godscan	Godscan	Godscan 是一款python编写的具有图形化界面的漏洞检测框架，可以之定义漏洞检测 poc ，主要是帮助安全测试者，更好的去记录和整理历史漏洞，以便更好的进行漏洞检测，提高工作效率！
pocassist	1.0.5	傻瓜式漏洞PoC测试框架
pocsuite3	v2.0.5	pocsuite3 is an open-sourced remote vulnerability testing fram ework developed by the Knownsec 404 Team.
Gr33k		图形化漏洞利用集成工具
kunpeng	2019052 7	kunpeng是一个Golang编写的开源POC框架/库，以动态链接库的形式提供各种语言调用，通过此项目可快速开发漏洞检测类的系统。
FrameScan-GUI	v1.4.3	FrameScan-GUI 一款python3和Pyqt编写的具有图形化界面的cms漏洞检测框架。

微信小程序辅助

项目名称	版本	项目描述
wxapkg	v1.5.0	微信小程序反编译工具，.wxapkg 文件扫描 + 解密 + 解包工具

信息泄露监控

项目名称	版本	项目描述
code6	1.6.4	码小六 - GitHub 代码泄露监控系统
gshark	v1.4.0	Scan for sensitive information easily and effectively.

中间件&框架漏洞扫描

项目名称	版本	项目描述
Jiraffe	v2.0.6	One stop place for exploiting Jira instances in your proximity
WeblogicScan		Weblogic一键漏洞检测工具，V1.5，更新时间：20200730
Artillery	v1.0_20 220519	JAVA 插件化漏洞扫描器，Gui基于javafx。POC 目前集成 Weblogic、T omcat、Shiro、Spring等。
weblogic-infodete ctor	0.2.4	woodpecker框架weblogic信息探测插件

漏洞利用库

OA产品漏洞

OA综合

项目名称	版本	项目描述
MYExploit	V2.0.4	OAExploit一款基于产品的一键扫描工具。
OA-EXPTOOL	0.83	OA综合利用工具，集合将近20款OA漏洞批量扫描

泛微OA

项目名称	版本	项目描述
CNVD-2021-49104		CNVD-2021-49104——泛微E-Office文件上传漏洞
DBconfigReader		泛微ecology OA系统接口存在数据库配置信息泄露漏洞
Weaver-OA-E-colog y-Database-Leak		泛微OA数据库配置泄漏检测脚本
e-cology-OA-SQL		泛微 e-cology OA 前台SQL注入
e-cology		e-cology OA_Beanshell_RCE

通达OA

项目名称	版本	项目描述
TongdaOATools
TDOA_RCE	v1.0	通达OA综合利用工具
TongDaOA-Fake-Use r		通达OA 任意用户登录漏洞
TongDa-OA		通达OA一些漏洞点

用友OA

项目名称	版本	项目描述
yonyou_exp_plus		用友系列全漏洞检测工具
fupo_for_yonyou	2.0RC1	用友漏洞检测，持续更新漏洞检测模块
yonyou-nc-decrypt er	0.1.0	用友 nc 系列密码解密
NCTOOls		一款针对用友NC综合漏洞利用工具
YongYouNcTool	1.0	用友NC系列漏洞检测利用工具，支持一键检测、命令执行回显、文件落地、一键打入内存马、文件读取等

致远OA

项目名称	版本	项目描述
SeeyonExploit-GUI		致远OA综合利用工具V1.0
PassDecode-jar	v0.1	帆软/致远密码解密工具
seeyon_exp		致远OA综合利用工具
A8-OA-seeyon-RCE		A Zhiyuan OA Collaborative Office Remote Code Execution Vulner ability on Windows

蓝凌OA

项目名称	版本	项目描述
Landray-OA-Treexm l-Rce		蓝凌OA远程代码执行漏洞批量检查
LandrayDES	V1	蓝凌OA的前后台密码的加解密工具

半自动化漏洞利用

项目名称	版本	项目描述
Goby	Beta2.2 .0	Attack surface mapping
railgun	v1.5.5
zpscan	v1.8.39	一个有点好用的信息收集工具。A somewhat useful information gath ering tool.

编辑器漏洞

UEditor

项目名称	版本	项目描述
UEditorGetShell		UEditor编辑器批量GetShell / Code By:Tas9er

产品

组件

####### 框架漏洞 ######## Apache Airflow

项目名称	版本	项目描述
CVE-2022-40127		Apache Airflow < 2.4.0 DAG example_bash_operator RCE POC
######## Apache Dubbo
项目名称	版本	项目描述
:----	:----	:----
dubbo-exp		dubbo学习demo，之前删了，重新上传。
######## Apache Log4j
项目名称	版本	项目描述
:----	:----	:----
log4jscanner	v0.5.0	A log4j vulnerability filesystem scanner and Go package for an alyzing JAR files.
logging-log4j2	rel/2.2 2.0	Apache Log4j 2 is a versatile, feature-rich, efficient logging API and backend for Java.
Log4j2-CVE-2021-4 4228		Remote Code Injection In Log4j
CVE-2021-44228-Po C-log4j-bypass-wor ds		🐱‍💻 ✂️ 🤬 CVE-2021-44228 - LOG4J Java exploit - WAF bypas s tricks
######## Apache Shiro
项目名称	版本	项目描述
:----	:----	:----
ShiroExploit-Depr ecated	v2.51	Shiro550/Shiro721 一键化利用工具，支持多种回显方式
shiro_attack	2.2	shiro反序列化漏洞综合利用,包含（回显执行命令/注入内存马）
ShiroAttack2	4.7.0	shiro反序列化漏洞综合利用,包含（回显执行命令/注入内存马）修复原版中NoCC的问题 https://github.com/j1anFen/shiro_attack
shiro_rce_tool		shiro 反序列命令执行辅助检测工具
SHIRO-550		Shiro RememberMe 1.2.4 反序列化漏洞
ShiroScan		Shiro<=1.2.4反序列化，一键检测工具
shiro-550-with-No CC	V1.1	Shiro-550 不依赖CC链利用工具
shiro-cve-2020-17 523		shiro-cve-2020-17523 漏洞的两种绕过姿势分析以及配套的漏洞环境
shiro-exploit		Shiro反序列化利用工具，支持新版本(AES-GCM)Shiro的key爆破，配合 ysoserial，生成回显Payload
######## Apache Solr
项目名称	版本	项目描述
:----	:----	:----
solr_exploit		Apache Solr远程代码执行漏洞(CVE-2019-0193) Exploit
CVE-2019-0193		Apache Solr DataImport Handler RCE
Apache-Solr-RCE		Apache Solr Exploits 🌟
solr-injection		Apache Solr Injection Research
CVE-2019-12409		Apache Solr RCE (ENABLE_REMOTE_JMX_OPTS="true")
solr_rce		Apache Solr RCE via Velocity template
Solr-SSRF		Apache Solr SSRF(CVE-2021-27905)
CVE-2019-17558_So lr_Vul_Tool	1.0	CVE-2019-17558 Solr模板注入漏洞图形化一键检测工具。CVE-2019-17 558 Solr Velocity Template Vul POC Tool.
CVE-2019-0192		RCE on Apache Solr using deserialization of untrusted data via jmx.serviceUrl
######## Apache Struts2
项目名称	版本	项目描述
:----	:----	:----
Struts2-Scan		Struts2全漏洞扫描利用工具
STS2G	1.0	Struts2漏洞扫描利用工具 - Golang版. Struts2 Scanner Written in Golang
struts-pwn_CVE-20 18-11776		An exploit for Apache Struts CVE-2018-11776
S2-053-CVE-2017-1 2611		A simple script for exploit RCE for Struts 2 S2-053(CVE-2017-1 2611)
struts-pwn		An exploit for Apache Struts CVE-2017-5638
struts-pwn_CVE-20 17-9805		An exploit for Apache Struts CVE-2017-9805
CVE-2019-0230		CVE-2019-0230 & s2-059 poc.
struts-scan		Python2编写的struts2漏洞全版本检测和利用工具
S2-061		some struts tag , attributes which out of the range will call SetDynamicAttribute() function, it will cause ONGL expression e xecute
Struts2Environmen t		Struts2 历史版本的漏洞环境
Struts2VulsTools	2.3.201 90927	Struts2系列漏洞检查工具
Struts-S2-xxx		整理收集Struts2漏洞环境
s2-016-exp		S2-016 Exploit && Scanner
######## Apache Tomcat
项目名称	版本	项目描述
:----	:----	:----
AttackTomcat	V1	Tomcat常见漏洞GUI利用工具。CVE-2017-12615 PUT文件上传漏洞、tom cat-pass-getshell 弱认证部署war包、弱口令爆破、CVE-2020-1938 To mcat AJP文件读取/包含
Tomcat_PUT_GUI_EX P	1.4	Tomcat PUT方法任意文件写入（CVE-2017-12615）exp
CVE-2017-12617		Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution
CVE-2019-0232		Apache Tomcat Remote Code Execution on Windows
CVE-2019-0232		Apache Tomcat Remote Code Execution on Windows - CGI-BIN
CVE-2017-12615		POC Exploit for Apache Tomcat 7.0.x CVE-2017-12615 PUT JSP vul nerability.
CVE-2020-9484		用Kali 2.0复现Apache Tomcat Session反序列化代码执行漏洞
######## Fastjson
项目名称	版本	项目描述
:----	:----	:----
FastjsonScan	v1.1	Fastjson扫描器，可识别版本、依赖库、autoType状态等。A tool to distinguish fastjson ,version and dependency
FastjsonExploit		Fastjson vulnerability quickly exploits the framework（fastjso n漏洞快速利用框架）
FastjsonVulns		[fastjson 1.2.80] CVE-2022-25845 aspectj fileread & groovy rem ote classload
fastjson-autotype -bypass-dem
fastjson_rec_expl oit		fastjson一键命令执行
Fastjson		Fastjson姿势技巧集合
fastjson	1.2.83	FASTJSON 2.0.x has been released, faster and more secure, reco mmend you upgrade.
fastjsonVul		fastjson 80 远程代码执行漏洞复现
fastjson-check	beta	fastjson 被动扫描、不出网payload生成
######## Hikvision
项目名称	版本	项目描述
:----	:----	:----
HikvisionDecode
######## IIS
项目名称	版本	项目描述
:----	:----	:----
IIS_shortname_Sca nner		an IIS shortname Scanner
######## JBoss
项目名称	版本	项目描述
:----	:----	:----
jexboss		JexBoss: Jboss (and Java Deserialization Vulnerabilities) veri fy and EXploitation Tool
jboss-_CVE-2017-1 2149		CVE-2017-12149 jboss反序列化可回显
######## log4j
项目名称	版本	项目描述
:----	:----	:----
log4j-shell-poc		A Proof-Of-Concept for the CVE-2021-44228 vulnerability.
######## SmartBI
项目名称	版本	项目描述
:----	:----	:----
SmartBIAttackTool	v1.0	SmartBI 登录代码逻辑漏洞导致的远程代码执行利用工具
######## Spring Boot
项目名称	版本	项目描述
:----	:----	:----
SpringBootExploit	1.3	项目是根据LandGrey/SpringBootVulExploit清单编写，目的hvv期间快速利用漏洞、降低漏洞利用门槛。
SpringBoot-Scan-G UI	v1.2.2
SpringExploit	0.1.9	🚀 一款为了学习go而诞生的漏洞利用工具
Spring_All_Reacha ble	v2.1	Spring漏洞综合利用工具
######## ThinkCMF
项目名称	版本	项目描述
:----	:----	:----
ThinkCMF_getshell		ThinkCMF 框架上的任意内容包含漏洞
######## Thinkphp
项目名称	版本	项目描述
:----	:----	:----
thinkphp_gui_tool s	v2.4.2	ThinkPHP漏洞综合利用工具, 图形化界面, 命令执行, 一键getshell, 批量检测, 日志遍历, session包含,宝塔绕过
VulnerabilityTool s		[CVE_2023_28432漏洞、CVE_2023_32315漏洞、 ThinkPHP 2.x 任意代码执行漏洞、ThinkPHP5 5.0.22/5.1.29 远程代码执行漏洞、 ThinkPHP 5 5.0.23 远程代码执行漏洞 ThinkPHP 多语言本地文件包含漏洞]
ThinkphpGUI	1.3	Thinkphp(GUI)漏洞利用工具，支持各版本TP漏洞检测，命令执行，get shell。
Aazhen-RexHa		自研JavaFX图形化漏洞扫描工具，支持扫描的漏洞分别是： ThinkPHP- 2.x-RCE， ThinkPHP-5.0.23-RCE， ThinkPHP5.0.x-5.0.23通杀RCE， T hinkPHP5-SQL注入&敏感信息泄露， ThinkPHP 3.x 日志泄露NO.1， Thi nkPHP 3.x 日志泄露NO.2， ThinkPHP 5.x 数
ThinkphpRCE		Thinkphp rce扫描脚本，附带日志扫描
thinkphp-RCE-POC- Collection		thinkphp v5.x 远程代码执行漏洞-POC集合
tphack		Thinkphp3/5 Log文件泄漏利用工具
tp5-getshell		thinkphp5 rce getshell
ThinkPHP-Vuln		关于ThinkPHP框架的历史漏洞分析集合
fastadmin		基于 ThinkPHP5 和 Bootstrap 的极速后台开发框架，一键生成 CRUD ，自动生成控制器、模型、视图、JS、语言包、菜单、回收站。
ThinkAdmin		基于 ThinkPHP6 的极简后台管理系统，内置注解权限、异步多任务、应用插件生态等，支持类 PaaS 更新公共模块和应用插件，插件可本地化定制开发。
TPscan		一键ThinkPHP漏洞检测
######## vmware
项目名称	版本	项目描述
:----	:----	:----
Vm4J		A tool for detect&exploit vmware product log4j(cve-2021-44228) vulnerability.Support VMware HCX/vCenter/NSX/Horizon/vRealize Operations Manager
VcenterKiller	v1.3.6	一款针对Vcenter的综合利用工具，包含目前最主流的CVE-2021-21972 、CVE-2021-21985以及CVE-2021-22005、One Access的CVE-2022-22954、 CVE-2022-22972/31656以及log4j，提供一键上传webshell，命令执行或者上传公钥使用SSH免密连接
######## Weblogic
项目名称	版本	项目描述
:----	:----	:----
CVE-2023-21839
weblogic-framewor k	v0.2.3	weblogic-framework is the best tool for detecting weblogic vul nerabilities.
WeblogicTool	v1.3	WeblogicTool，GUI漏洞利用工具，支持漏洞检测、命令执行、内存马注入、密码解密等（深信服深蓝实验室天威战队强力驱动）
Decrypt_Weblogic_ Password		搜集了市面上绝大部分weblogic解密方式，整理了7种解密weblogic的方法及响应工具。
weblogicScanner		weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014- 4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-350 6、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894 、CVE-2018-3191、CVE-2018
CVE-2017-10271		CVE-2017-10271 WEBLOGIC RCE (TESTED)
Weblogic		Weblogic CVE-2019-2725 CVE-2019-2729 Getshell 命令执行
WebLogicPasswordD ecryptorUi	v2.0	解密weblogic AES或DES加密方法
WeblogicScan		增强版WeblogicScan、检测结果更精确、插件化、添加CVE-2019-2618 ，CVE-2019-2729检测，Python3支持
CVE-2020-2551		how detect CVE-2020-2551 poc exploit python Weblogic RCE with IIOP
CNVD-C-2019-48814		WebLogic wls9-async反序列化远程命令执行漏洞
cve-2019-2618		Weblogic Upload Vuln(Need username password)-CVE-2019-2618
CVE-2019-2890		CVE-2019-2890 WebLogic 反序列化RCE漏洞
CVE-2020-2551		Weblogic RCE with IIOP
CVE-2018-2894		CVE-2018-2894 WebLogic Unrestricted File Upload Lead To RCE Ch eck Script
WeblogicEnvironme nt		Weblogic环境搭建工具
WeblogicScanLot		WeblogicScanLot系列，Weblogic漏洞批量检测工具，V2.2
CVE-2020-14645		Weblogic CVE-2020-14645 UniversalExtractor JNDI injection getD atabaseMetaData()
CVE-2020-14756		WebLogic T3/IIOP RCE ExternalizableHelper.class of coherence.j ar
CVE-2020-2551		Weblogic IIOP CVE-2020-2551
CVE-2020-2555		Weblogic com.tangosol.util.extractor.ReflectionExtractor RCE
CVE-2020-2883		Weblogic coherence.jar RCE
######## Nacos
项目名称	版本	项目描述
:----	:----	:----
HKEcho_Nacos

常规web漏洞

CLRF

项目名称	版本	项目描述
CRLFsuite

CORS

项目名称	版本	项目描述
CORScanner	1.0.1	🎯 Fast CORS misconfiguration vulnerabilities scanner

DOS

项目名称	版本	项目描述
slowhttptest	v1.9.0	Application Layer DoS attack simulator

JWT

项目名称	版本	项目描述
JWT_GUI	replace _brute_e rror	基于pyqt5和pyjwt实现的jwt加解密爆破一体化工具(ps:其实是水的pyt hon课设)
JWTPyCrack		JWT 弱口令 Key 爆破以及生成 NONE 加密的无 Key 的 JWTString
jwt-hack	v1.1.2	🔩 jwt-hack is tool for hacking / security testing to JWT. Sup ported for En/decoding JWT, Generate payload for JWT attack and very fast cracking(dict/brutefoce)
jwt_tool	v2.2.6	🐍 A toolkit for testing, tweaking and cracking JSON Web Tokens
RS256-2-HS256		JWT Attack to change the algorithm RS256 to HS256
c-jwt-cracker		JWT brute force cracker written in C
jwt-fuzzer		JWT fuzzer
JWT4B	2.3	JWT Support for Burp

SQL注入

项目名称	版本	项目描述
ghauri	1.2.9	An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws
sqlmap	1.7	Automatic SQL injection and database takeover tool
MSSQL_SQL_BYPASS_ WIKI		MSSQL注入提权,bypass的一些总结
MYSQL_SQL_BYPASS_ WIKI		mysql注入,bypass的一些心得
sql-injection-pay load-list		🎯 SQL Injection Payload List

SSRF

项目名称	版本	项目描述
SSRFmap		Automatic SSRF fuzzer and exploitation tool
ssrf-sheriff		A simple SSRF-testing sheriff written in Go

SSTI

项目名称	版本	项目描述
tplmap	v0.5	Server-Side Template Injection and Code Injection Detection an d Exploitation Tool
SSTImap	v1.1	Automatic SSTI detection tool with interactive interface
ssti-payload		SSTI Payload Generator

XSS

项目名称	版本	项目描述
beef	v0.5.4. 0	The Browser Exploitation Framework Project
xsscrapy		XSS spider - 66/66 wavsep XSS detected
findom-xss		A fast DOM based XSS vulnerability scanner with simplicity.
dalfox	v2.9.1	🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.
Chromium-based-XS S-Taint-Tracking	v0.3	Cyclops 是一款具有 XSS 检测功能的浏览器

XXE

项目名称	版本	项目描述
oxml_xxe		A tool for embedding XXE/XML exploits into different filetypes
docem	1.3	Uility to embed XXE and XSS payloads in docx,odt,pptx,etc (OX ML_XEE on steroids)

解析漏洞

####### Nginx

项目名称	版本	项目描述
nginxpwner		Nginxpwner is a simple tool to look for common Nginx misconfig urations and vulnerabilities.

文件包含

项目名称	版本	项目描述
liffy		Local file inclusion exploitation tool

漏洞检测利用仓库

项目名称	版本	项目描述
PocList		Alibaba-Nacos-Unauthorized/ApacheDruid-RCE_CVE-2021-25646/MS-E xchange-SSRF-CVE-2021-26885/Oracle-WebLogic-CVE-2021-2109_RCE/R G-CNVD-2021-14536/RJ-SSL-VPN-UltraVires/Redis-Unauthori
Some-PoC-oR-ExP		各种漏洞poc、Exp的收集或编写
POChouse		POC&EXP仓库、hvv弹药库、Nday、1day
0day		各种CMS、各种平台、各种系统、各种软件漏洞的EXP、POC ,该项目将持续更新
vulnerability		收集、整理、修改互联网上公开的漏洞POC
Awesome-Exploit		一个漏洞利用工具仓库
CVE-Master	v1.0.1	收集本人自接触渗透测试用于漏洞验证的所有热门CVE、POC、CNVD攻击有效载荷+测试工具+FUZZ,一个仓库满足许多攻击测试场景,开箱即用.
poc-hub
PocOrExp_in_Githu b		聚合Github上已有的Poc或者Exp，CVE信息来自CVE官网。Auto Collect Poc Or Exp from Github by CVE ID.
exphub		Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、S olr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2 020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2 020-2551、CVE-2020-2555、C

漏洞利用辅助

项目名称	版本	项目描述
JNDIExploit	1.1	一款用于JNDI注入利用的工具，大量参考/引用了Rogue JNDI项目的代码，支持直接植入内存shell，并集成了常见的bypass 高版本JDK的方式，适用于与自动化工具配合使用。
cola_dnslog	v1.3.2	Cola Dnslog v1.3.2 更加强大的dnslog平台/无回显漏洞探测辅助平台完全开源 dnslog httplog ldaplog rmilog 支持dns http ldap rmi等协议提供API调用方式便于与其他工具结合支持钉钉机器人、Bark等提醒支持docker一键部署后端完全使用python实现前端基于vue-elemen
godnslog	v0.7.0	An exquisite dns&http log server for verify SSRF/XXE/RFI/RCE v ulnerability
Exp-Tools	v1.2.3	一款集成高危漏洞exp的实用性工具
ysoserial	v0.0.6	A proof-of-concept tool for generating payloads that exploit u nsafe Java object deserialization.
DNSlog-GO	master	DNSLog-GO 是一款golang编写的监控 DNS 解析记录的工具，自带WEB界面 / DNSLog-GO is a monitoring tool written in Golang that monit ors DNS resolution records. It comes with a web interface.
revsuit	v0.7.1	RevSuit is a flexible and powerful reverse connection platform designed for receiving connection from target host in penetrat ion.
JNDIExploit-1	v1.2	一款用于 JNDI注入利用的工具，大量参考/引用了 Rogue JNDI 项目的代码，支持直接植入内存shell，并集成了常见的bypass 高版本JDK的方式，适用于与自动化工具配合使用。（from https://github.com/feih ong-cs/JNDIExploit）
JNDIExploit
ddddocr		带带弟弟通用验证码识别OCR pypi版
ysoserial
Gopherus		This tool generates gopher link for exploiting SSRF and gainin g RCE in various servers
ysomap	v0.1.5	A helpful Java Deserialization exploit framework.
JNDIExploit	v1.4	对原版https://github.com/feihong-cs/JNDIExploit 进行了实用化修改
Antenna	v1.3.5	Antenna是58同城安全团队打造的一款辅助安全从业人员验证网络中多种漏洞是否存在以及可利用性的工具。其基于带外应用安全测试(OAST)通过任务的形式，将不同漏洞场景检测能力通过插件的形式进行集合，通过与目标进行out-bind的数据通信方式进行辅助检测。
jndi_tool		JNDI服务利用工具 RMI/LDAP，支持部分场景回显、内存shell，高版本 JDK场景下利用等，fastjson rce命令执行，log4j rce命令执行漏洞检测辅助工具
DNSLog		DNSLog 是一款监控 DNS 解析记录和 HTTP 访问记录的工具。
Alphalog	1.0.0.R elease	DNSLOG、httplog、rmilog、ldaplog、jndi 等都支持,完全匿名产品( fuzz.red)，Alphalog与传统DNSLog不同，更快、更安全。
DNSLog-Platform-G olang	v0.3	DNSLOG平台 golang
JNDI-Exploit-Kit		JNDI-Exploitation-Kit（A modified version of the great JNDI-In jection-Exploit created by @welk1n. This tool can be used to st art an HTTP Server, RMI Server and LDAP Server to exploi
JNDI-Injection-Ex ploit	v1.0	JNDI注入测试工具（A tool which generates JNDI links can start several servers to exploit JNDI Injection vulnerability,like Ja ckson,Fastjson,etc）
JNDIMonitor		一个LDAP请求监听器，摆脱dnslog平台

漏洞利用框架

项目名称	版本	项目描述
woodpecker-framew ork-release	1.3.5	高危漏洞精准检测与深度利用框架

漏洞文库

项目名称	版本	项目描述
VulWiki		VulWiki
FrameVul		POC集合，框架nday漏洞利用
bylibrary		白阁文库是白泽Sec安全团队维护的一个漏洞POC和EXP公开项目
vulbase		各大漏洞文库合集
PoC-ExP		【漏洞Poc知识库】一个网络安全爱好者对网络上一些已知漏洞payload 的收录，持续更新。并编写了利用脚本，可用于日常学习或批量的src漏洞挖掘
Report_Public		DVPNET 公开漏洞知识库
yougar0.github.io		漏洞知识库
BUG-Pocket		小型漏洞库，提供FOFA语法及批量脚本，具体利用法请参考别的漏洞库，共4种类型47项
PeiQi-WIKI-Book		面向网络安全从业者的知识文库🍃
WiKi		稻草人安全团队漏洞库
Awesome-POC		一个漏洞POC知识库
Vulhub-Reproduce		一个Vulhub漏洞复现知识库
Vulnerability-Wik i	v1.0	基于 docsify 部署，目前漏洞数量 1000+
PoC-in-GitHub		📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

信息泄露漏洞

.DS_Store泄露

项目名称	版本	项目描述
ds_store_exp		A .DS_Store file disclosure exploit. It parses .DS_Store file and downloads files recursively.

.git泄露

项目名称	版本	项目描述
git-dumper		A tool to dump a git repository from a website
GitHack		.git 泄漏利用工具，可还原历史版本
scrabble		Simple tool to recover .git folder from remote server
GitHack		A .git folder disclosure exploit
GitDorker		A Python program to scrape secrets from GitHub through usage o f a large repository of dorks.
Git_Extract		提取远程 git 泄露或本地 git 的工具

.svn泄露

项目名称	版本	项目描述
svnExploit		SvnExploit支持SVN源代码泄露全版本Dump源码

heapdump泄露

项目名称	版本	项目描述
JDumpSpider	dev-202 30406T03 1230	HeapDump敏感信息提取工具
heapdump_tool		heapdump敏感信息查询工具，例如查找 spring heapdump中的密码明文，AK,SK等

idea

项目名称	版本	项目描述
idea_exploit		Gather sensitive information from (.idea) folder for pentester s

key泄露

项目名称	版本	项目描述
cloudTools	main	云资产管理工具目前工具定位是云安全相关工具，目前是两个模块云存储工具、云服务工具，云存储工具主要是针对oss存储、查看、删除、上传、下载、预览等等云服务工具主要是针对rds、服务器的管理，查看、执行命令、接管等等
AliyunAccessKeyTo ols	1.0	阿里云AccessKey泄漏利用工具
API-T00L	v1.2	互联网厂商API利用工具。
cf
Cloud-Bucket-Leak -Detection-Tools	v0.4.0	六大云存储，泄露利用检测工具
aksk_tool		AK资源管理工具，阿里云/腾讯云/华为云/AWS/UCLOUD/京东云/百度云/ 七牛云存储 AccessKey AccessKeySecret，利用AK获取资源信息和操作资源，ECS/CVM/E2/UHOST/ECI/BCC执行命令，OSS/COS/S3/BOS管理，RDS/DB 管理，域名管理，添加RAM/CAM/IAM账号等

swagger接口

项目名称	版本	项目描述
swagger-hack		自动化爬取并自动测试所有swagger接口
swagger-exp		A Swagger API Exploit

Webpack接口

项目名称	版本	项目描述
Packer-Fuzzer	v1.4	Packer Fuzzer is a fast and efficient scanner for security det ection of websites constructed by javascript module bundler suc h as Webpack.

代码泄露综合

项目名称	版本	项目描述
dvcs-ripper		Rip web accessible (distributed) version control systems: SVN/ GIT/HG...
dumpall	v0.4.0	一款信息泄漏利用工具，适用于.git/.svn/.DS_Store泄漏和目录列出

敏感数据泄露

项目名称	版本	项目描述
JSFScan.sh		Automation for javascript recon in bug bounty.
SecretFinder		SecretFinder - A python script for find sensitive data (apikey s, accesstoken,jwt,..) and search anything on javascript files
Mantra	v.1.1	「🔑」A tool used to hunt down API key leaks in JS files and p ages

重点CMS利用

项目名称	版本	项目描述
wprecon
wpreconx	2.4.5	WPRecon, is a tool for the recognition of vulnerabilities and blackbox information for wordpress.
CMSmap		CMSmap is a python open source CMS scanner that automates the process of detecting security flaws of the most popular CMSs.
QVD-2023-13065		Nacos JRaft Hessian 反序列化 RCE EXP
wordpress-exploit -framework	v2.0.1	A Ruby framework designed to aid in the penetration testing of WordPress systems.
CVE-2023-33246		Apache RocketMQ 远程代码执行漏洞(CVE-2023-33246) Exploit
EgGateWayGetShell		Code By:Tas9er
Apt_t00ls	v0.7	高危漏洞利用工具
wpscan	v3.8.25	WPScan WordPress security scanner. Written for security profes sionals and blog maintainers to test the security of their Word Press websites. Contact us via [email protected]
LandrayExploit
weaver_exp		泛微OA漏洞综合利用脚本
2021hvv_vul		2021hvv漏洞汇总
CMS-Exploit-Frame work		CMS Exploit Framework
CMS-Hunter		CMS漏洞测试用例集合

子域接管

项目名称	版本	项目描述
SubOver	v1.2	A Powerful Subdomain Takeover Tool

端口服务安全

服务漏洞

JDWP

项目名称	版本	项目描述
jdwp-shellifier
jdwp-shellifier		修改利用方式为通过对Sleeping的线程发送单步执行事件，达成断点，从而可以直接获取上下文、执行命令，而不用等待断点被击中。
jdwp-codeifier		基于 jdwp-shellifier 的进阶JDWP漏洞利用脚本（动态执行Java/Js代码并获得回显）

rdp

项目名称	版本	项目描述
CVE-2019-0708		3389远程桌面代码执行漏洞CVE-2019-0708批量检测工具(Rdpscan Blue keep Check)
CVE-2019-0708		CVE-2019-0708 (BlueKeep)

RMI

项目名称	版本	项目描述
attackRmi	v2.0
rmiscout	v1.4	RMIScout uses wordlist and bruteforce strategies to enumerate Java RMI functions and exploit RMI parameter unmarshalling vuln erabilities
BaRMIe	v1.01	Java RMI enumeration and attack tool.
attackRmi	v0.1	attackRmi

数据库利用

mssql

项目名称	版本	项目描述
mssqlproxy	0.1	mssqlproxy is a toolkit aimed to perform lateral movement in r estricted environments through a compromised Microsoft SQL Serv er via socket reuse
SharpSQLTools	41	SharpSQLTools 和@Rcoil一起写的小工具，可上传下载文件，xp_cmdsh ell与sp_oacreate执行命令回显和clr加载程序集执行相应操作。
SqlKnife_0x727	1.2	适合在命令行中使用的轻巧的SQL Server数据库安全检测工具
PySQLTools		Mssql利用工具

Oracle

项目名称	版本	项目描述
odat	5.1.1	ODAT: Oracle Database Attacking Tool
oracleShell		oracle 数据库命令执行

postgresql

项目名称	版本	项目描述
postgresql_udf_he lp		PostgreSQL 提权辅助脚本

redis

项目名称	版本	项目描述
RabR	0.6.2	Redis-Attack By Replication (通过主从复制攻击Redis)
redis-rogue-serve r		Redis 4.x/5.x RCE
redis-rogue-serve r		Redis(<=5.0.5) RCE
redis-rce		Redis 4.x/5.x RCE
RedisEXP	0.0.3	Redis 漏洞利用工具
redis_rce	v0.1.0	Redis primary/secondary replication RCE
RedisModules-Exec uteCommand-for-Win dows		可在Windows下执行系统命令的Redis模块，可用于Redis主从复制攻击。

综合

项目名称	版本	项目描述
RequestTemplate
Databasetools	1.2	一款用Go语言编写的数据库自动化提权工具，支持Mysql、MSSQL、Post gresql、Oracle、Redis数据库提权、命令执行、爆破以及ssh连接
MDUT	v2.1.1	MDUT - Multiple Database Utilization Tools
PentestDB		各种数据库的利用姿势

后渗透

代理转发

项目名称	版本	项目描述
		http://rootkiter.com/Termite/
dns2tcp	v0.5.2
nps	v0.26.1 0	一款轻量级、高性能、功能强大的内网穿透代理服务器。支持tcp、udp 、socks5、http等几乎所有流量转发，可用来访问内网网站、本地支付接口调试、ssh访问、远程桌面，内网dns解析、内网socks5代理等等……，并带有功能强大的web管理端。a lightweight, high-performance, powe rful intranet penet
pingtunnel	2.8	Pingtunnel is a tool that send TCP/UDP traffic over ICMP
frp	v0.53.0	A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
pystinger	v1.6	Bypass firewall for traffic forwarding using webshell 一款使用 webshell进行流量转发的出网工具
Erfrp	v0.1	Erfrp-frp二开-免杀与隐藏
dnscat2
ngrok		Introspected tunnels to localhost
icmpsh
PortForward	0.5.0	The port forwarding tool developed by Golang solves the proble m that the internal and external networks cannot communicate in certain scenarios
Neo-reGeorg	v5.1.0	Neo-reGeorg is a project that seeks to aggressively refactor r eGeorg
rakshasa	v0.2.3	基于go编写的跨平台、稳定、隐秘的多级代理内网穿透工具
frp_cmd	v0.38.0 _modify	frp修改版，增加socks、pf命令，便捷启用socks5代理、端口转发，且去除流量特征，增加loadini命令，支持命令行参数导入base64编码的配置文件
Stowaway	v2.1	👻Stowaway -- Multi-hop Proxy Tool for pentesters
slcx	v1.0.2	端口转发工具，绕过流量安全检测。
reGeorg		The successor to reDuh, pwn a bastion webserver and create SOC KS proxies through the DMZ. Pivot and pwn.
goproxy	v14.1	🔥 Proxy is a high performance HTTP(S) proxies, SOCKS5 proxies ,WEBSOCKET, TCP, UDP proxy server implemented by golang. Now, i t supports chain-style proxies,nat forwarding in differe
suo5	v0.9.0	一款高性能 HTTP 代理隧道工具
		https://www.proxifier.com/

内网横向工具

项目名称	版本	项目描述
Intranet-Movement -Kit	V1.0	内网横向移动工具箱
OLa	OLa__20 220724
impacket	impacke t_0_11_0	Impacket is a collection of Python classes for working with ne twork protocols.
VMInjector		DLL Injection tool to unlock guest VMs
Intranet-tools
sharpwmi	v2	sharpwmi是一个基于rpc的横向移动工具，具有上传文件和执行命令功能。
WMIHACKER		A Bypass Anti-virus Software Lateral Movement Command Executio n Tool
java-impacket-gui		java-impacket-gui
Impacket_For_Web
wmiexec-Pro	v0.2.6	New generation of wmiexec.py
impacket-gui		impacket-gui
		https://xz.aliyun.com/t/9382

内网漏洞发现

项目名称	版本	项目描述
Template	v1.2.5	Next generation RedTeam heuristic intranet scanning
ServerScan	v1.0.2	ServerScan一款使用Golang开发的高并发网络扫描、服务探测工具。
ADCSKiller		An ADCS Exploitation Automation Tool Weaponizing Certipy and C oercer
Gscan	v1.0	Gscan is a high concurrency scanner based on golang
goon	v3.5	goon,集合了fscan和kscan等优秀工具功能的扫描爆破工具。功能包含：ip探活、port扫描、web指纹扫描、title扫描、压缩文件扫描、fofa获取、ms17010、mssql、mysql、postgres、redis、ssh、smb、rdp、telne t、tomcat等爆破以及如netbios探测等功能。
InScan		边界打点后的自动化渗透工具
kscan	v1.85	Kscan是一款纯go开发的全方位扫描器，具备端口扫描、协议检测、指纹识别，暴力破解等功能。支持协议1200+，协议指纹10000+，应用指纹2 0000+，暴力破解协议10余种。
fscan	1.8.3	一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。

内网信息收集

项目名称	版本	项目描述
ATAttack		敌后侦察
netspy	v0.0.5	netspy是一款快速探测内网可达网段工具（深信服深蓝实验室天威战队强力驱动）
SharpHostInfo	v0.0.1	SharpHostInfo是一款快速探测内网主机信息工具（深信服深蓝实验室天威战队强力驱动）
HostInfoScan		红队小工具
netdiscover		netdiscover
Adinfo	v0.3	域信息收集工具
ClipboardHistoryT hief		POC tool to extract all persistent clipboard history data from clipboard service process memory
TakeMyRDP		A keystroke logger targeting the Remote Desktop Protocol (RDP) related processes, It utilizes a low-level keyboard input hook , allowing it to record keystrokes in certain contexts

权限提升

linux提权

项目名称	版本	项目描述
PEASS-ng	2023121 0-89d560 ba	PEASS - Privilege Escalation Awesome Scripts SUITE (with color s)
dirtycow		Dirty Cow exploit - CVE-2016-5195
traitor	v0.0.14	⬆️ ☠️ 🔥 Automatic Linux prive sc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock
LinEnum		Scripted Local Linux Enumeration & Privilege Escalation Checks
		https://i.hacking8.com/tiquan/

windows提权

项目名称	版本	项目描述
BadPotato		Windows 权限提升 BadPotato
Windows-exploits	Windows Exploits Collecti ons	Windows 平台提权漏洞大合集，长期收集各种提权漏洞利用工具。 A l arge collection of rights raising vulnerabilities on the window s platform, which collects various rights raising vulnerability utilization tool
CoercedPotato

综合

项目名称	版本	项目描述
Kernelhub	v1.1	🌴Linux、macOS、Windows Kernel privilege escalation v ulnerability collection, with compilation environment, demo GIF map, vulnerability details, executable file (提权漏洞合集)

权限维持

Shell管理

项目名称	版本	项目描述
antSword	2.1.15	**蚁剑是一款跨平台的开源网站管理工具。AntSword is a cross-pl atform website management toolkit.
Godzilla	v4.0.1- godzilla	哥斯拉
WebshellManager		w8ay 一句话WEB端管理工具
Cknife		Cknife
Webshell_Generate	v1.2.3	用于生成各类免杀webshell
java-memshell-gen erator-release	v1.0.7. beta3	一款支持高度自定义的 Java 内存马生成工具
Behinder	Behinde r_v4.0.6	“冰蝎”动态二进制加密网站管理客户端
Platypus	v1.5.0	🔨 A modern multiple reverse shell sessions manager writ ten in go
As-Exploits		**蚁剑后渗透框架

webshell

项目名称	版本	项目描述
webshell		这是一些常用的webshell
AwesomeScript		AntSword Shell 脚本分享/示例
AntSword-Loader	4.0.3	AntSword 加载器
AwesomeEncoder		AntSword 自定义编(解)码器分享
vagent	v1.0.0	多功能 java agent 内存马

后门

项目名称	版本	项目描述
CloneX_0x727	1.0	进行克隆用户、添加用户等账户防护安全检测的轻巧工具
SchTask_0x727	v1.0	创建隐藏计划任务，权限维持，Bypass AV
HackerPermKeeper	6.0
CreateHiddenAccou nt	0.2	A tool for creating hidden accounts using the registry
ShadowUser		影子用户克隆

免杀

项目名称	版本	项目描述
AV_Evasion_Tool	2023082 3	掩日 - 免杀执行器生成工具
killEscaper		Shellcode 免杀生成器绕过火绒、360（Windows版本）
ShellCode_Loader	v0.0.1	ShellCode_Loader - Msf&CobaltStrike免杀ShellCode加载器、Shellc ode_encryption - 免杀Shellcode加密生成工具，目前测试免杀360&火绒&电脑管家&Windows Defender（其他杀软未测试）。
encdecshellcode		Shellcode Encrypter & Decrypter via XOR Cipher
SysWhispers2		AV/EDR evasion via direct system calls.
shellcodeloader	v1.1	shellcodeloader
GobypassAV-shellc ode		shellcode免杀加载器，使用go实现，免杀bypass火绒、360、核晶、de f等主流杀软
Qianji	Qianji_ BypassAV -sandbox -2023111 5	千机-红队免杀木马自动生成器 Bypass defender、火绒、360等国内主流杀软随机加密混淆shellcode快速生成免杀马
bypassAV		免杀shellcode加载器
BypassAntiVirus		远控免杀系列文章及配套工具，汇总测试了互联网上的几十种免杀工具、113种白名单免杀方式、8种代码编译免杀、若干免杀实战技术，并对免杀效果进行了一一测试，为远控的免杀和杀软对抗免杀提供参考。
GoBypassAV		整理了基于Go的16种API免杀测试、8种加密测试、反沙盒测试、编译混淆、加壳、资源修改等免杀技术，并搜集汇总了一些资料和工具。
SharpShellcodeLoa der_Rc4Aes		用于解密并加载shellcode，支持RC4和AES两种解密方法，并使用DInvo ke来动态调用WinAPI函数，从而尝试绕过某些安全解决方案
noterce	1.3	一种另辟蹊径的免杀执行系统命令的木马
ZheTian	v3	::ZheTian / 强大的免杀生成工具，Bypass All.
go-shellcode		Load shellcode into a new process
0xUBypass	1.0.0	AntiAV shellcode loader

免杀相关

签名伪造

项目名称	版本	项目描述
Sign-Sacker		Sign-Sacker(签名掠夺者)：一款数字签名复制器，可将其他官方exe中数字签名，图标，详细信息复制到没有签名的exe中，作为免杀，权限维持，伪装的一种小手段。
SigThief		Stealing Signatures and Making One Invalid Signature at a Time

图标提取

项目名称	版本	项目描述
BeCyIconGrabberPo rtable		BeCyIconGrabber allows you to extract icons from almost any fi le!

文件时间修改

项目名称	版本	项目描述
ChTimeStamp		Changing the Creation time and the Last Written time of a drop ped file by the timestamp of other one , like the "kernel32.dll " timestamp
ChangeTimestamp		一键修改exe、dll的编译时间、创建时间、修改时间和访问时间

痕迹隐藏

项目名称	版本	项目描述
go-strip	v3.0	清除Go编译时自带的信息

远控

项目名称	版本	项目描述
trojan_simple_dem o		简单的用python写的远控demo 执行命令只一个心跳完成所有操作
Supershell	v2.0.0	Supershell C2 远控平台，基于反向SSH隧道获取完全交互式Shell
SimpleRemoter	v1.0.0. 5	基于gh0st的远程控制器：实现了终端管理、进程管理、窗口管理、远程桌面、文件管理、语音管理、视频管理、服务管理、注册表管理等功能，优化全部代码及整理排版，修复内存泄漏缺陷，程序运行稳定。项目代码仅限于学习和交流用途。
sliver	v1.5.41	Adversary Emulation Framework

域渗透工具

项目名称	版本	项目描述
ShuiYing_0x727	V1.0	检测域环境内，域机器的本地管理组成员是否存在弱口令和通用口令，对域用户的权限分配以及域内委派查询
BloodHound	v4.3.1	Six Degrees of Domain Admin

综合

项目名称	版本	项目描述
Viper	2023-12 -03-13-4 4-27	Redteam operation platform with webui 图形化红队行动辅助平台
Ladon	v12.0	Ladon大型内网渗透工具，可PowerShell模块化、可CS插件化、可内存加载，无文件扫描。含端口扫描、服务识别、网络资产探测、密码审计、高危漏洞检测、漏洞利用、密码读取以及一键GetShell，支持批量A段/B 段/C段以及跨网段扫描，支持URL、主机、域名列表扫描等。Ladon 12.0 内置256个功能,网络资产探测模块32个通过多种协议(ICMP\N

后渗透框架

项目名称	版本	项目描述
metasploit-framew ork		Metasploit Framework

社工

钓鱼辅助

项目名称	版本	项目描述
EmailSender		钓鱼邮件便捷发送工具（GUI）
goblin	v0.4.6	一款适用于红蓝对抗中的仿真钓鱼系统

信息收集

apk

项目名称	版本	项目描述
Mobile-Security-F ramework-MobSF	v3.7.6	Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware a nalysis and security assessment framework capable of pe
ApkAnalyser		一键提取安卓应用中可能存在的敏感信息。

C段信息收集

项目名称	版本	项目描述
IPSearch	v0.1	离线IP Whois查询工具。可根据IP查询所属IP段信息、根据关键词查询 IP段信息

IP反查域名

项目名称	版本	项目描述
iplookup	v1.1	IP反查域名
reverseip_py		Domain Parser for IPAddress.com Reverse IP Lookup

WAF识别

项目名称	版本	项目描述
identYwaf		Blind WAF identification tool

端口扫描

项目名称	版本	项目描述
portscan
TXPortMap	v1.1.2	Port Scanner & Banner Identify From TianXiang
yujianportscan		一个基于VB.NET + IOCP模型开发的高效端口扫描工具，支持IP区间合并，端口区间合并，端口指纹深度探测
webfinder-next		对小米范webfinder http://www.cnblogs.com/SEC-fsq/p/5610981.htm l 进行了小修改
naabu	v2.2.0	A fast port scanner written in go with a focus on reliability and simplicity. Designed to be used in combination with other t ools for attack surface discovery in bug bounties and p
scaninfo	v1.1.0	fast scan for redtools

反查域名

项目名称	版本	项目描述
ipInfoSearch		ip域名反查、权重查询以及ICP备案查询。便于提交SRC时资产过滤。

目录扫描

项目名称	版本	项目描述
rad	1.0
Dirscan	v.1.5.2	Dirscan是一款由go编写的高性能、高并发的目录扫描器，现在已经支持GET、HEAD、递归扫描、代理、爬虫等功能功能,后续努力实现更多功能。
cansina	1.0.0	Web Content Discovery Tool
feroxbuster	v2.10.1	A fast, simple, recursive content discovery tool written in Ru st.
ffuf	v2.1.0	Fast web fuzzer written in Go
yjdirscan	yjdirsc an	御剑目录扫描专业版，简单实用的命令行网站目录扫描工具，支持爬虫、fuzz、自定义字典、字典变量、UA修改、假404自动过滤、扫描控速等功能。
dirmap		An advanced web directory & file scanning tool that will be mo re powerful than DirBuster, Dirsearch, cansina, and Yu Jian.一个高级web目录、文件扫描工具，功能将会强于DirBuster、Dirsearch、c ansina、御剑。
yuhScan	v1.0	web目录快速扫描工具
gospider	v1.1.6	Gospider - Fast web spider written in Go
dirsearch_bypass4 03	v0.2	目录扫描+JS文件中提取URL和子域+403状态绕过+指纹识别
BBScan	v1.5	A fast vulnerability scanner
dirsearch	v0.4.3	Web path scanner
URLFinder	2023.9. 9	一款快速、全面、易用的页面信息提取工具，可快速发现和提取页面中的JS、URL和敏感信息。
urlbrute	v1.0.2	Directory/Subdomain scanner developed in GoLang.
SWebScan	5.0.201 8.08.21	SWebScan是一款基于C#的Web目录扫描器。
JSFinder		JSFinder is a tool for quickly extracting URLs and subdomains from JS files on a website.
ihoneyBakFileScan _Modify		批量网站备份文件扫描器，增加文件规则，优化内存占用

企业信息收集

项目名称	版本	项目描述
IEyes	v0.1.2	icp备案查询
ENScan_GO	0.0.15	一款基于各大企业信息API的工具，解决在遇到的各种针对国内企业信息收集难题。一键收集控股公司ICP备案、APP、小程序、微信公众号等信息聚合导出。

小程序信息收集

项目名称	版本	项目描述
wxapkgUnpack	1.0	wxapkg解密解包工具，提供C#和wxappUnpacker两个版本的解包，并提取JS中的URL和IP。

邮箱信息收集

项目名称	版本	项目描述
EmailAll		EmailAll is a powerful Email Collect tool — 一款强大的邮箱收集工具

域名信息查询

项目名称	版本	项目描述
QueryTools		IP/域名资产验证神器(补天

指纹识别

项目名称	版本	项目描述
ObserverWard	v2023.1 1.29	Cross platform community web fingerprint identification tool
14Finger	V1.1	功能齐全的Web指纹识别和分享平台,基于vue3+django前后端分离的web 架构，并集成了长亭出品的rad爬虫的功能，内置了一万多条互联网开源的指纹信息。
Finger		一款红队在大量的资产中存活探测与重点攻击系统指纹探测工具
EHole	v3.1	EHole(棱洞)3.0 重构版-红队重点攻击系统指纹探测工具
LazyDog	1.1	LazyDog是一款通过网络空间测绘引擎读取资产并进行指纹识别的工具
Find-SomeThing		红队批量脆弱点搜集工具
wappalyzergo	v0.0.10 9	A high performance go implementation of Wappalyzer Technology Detection Library
Glass		Glass是一款针对资产列表的快速指纹识别工具，通过调用Fofa/ZoomEy e/Shodan/360等api接口快速查询资产信息并识别重点资产的指纹，也可针对IP/IP段或资产列表进行快速的指纹识别。
TideFinger		TideFinger——指纹识别小工具，汲取整合了多个web指纹库，结合了多种指纹检测方法，让指纹检测更快捷、准确。
WhatWeb	v0.5.5	Next generation web scanner
whatweb-plus	v0.5.5. 19.fix	whatweb 增强版 8000+插件（提供windows可执行文件）
FingerprintHub	default	侦查守卫(ObserverWard)的指纹库
rules		通用的指纹识别规则

资产测绘采集

项目名称	版本	项目描述
koko-moni	v0.0.1	一个网络空间搜索引擎监控平台，可定时进行资产信息爬取，及时发现新增资产，本项目聚合了 Fofa、Hunter、Quake、Zoomeye 和 Threatboo k 的数据源，并对获取到的数据进行去重与清洗
InfoSearchAll
Search_Viewer	v3.0	集Fofa、Hunter鹰图、Shodan、360 quake、Zoomeye 钟馗之眼、censy s 为一体的空间测绘gui图形界面化工具，支持一键采集爬取和导出fofa 、shodan等数据，方便快捷查看
TKHunter	TKHunte r-v1.8	一个基于JavaFX写的一个Hunter资产测绘平台的图形化工具
fshzqSearch
AsamF	v0.2.5	AsamF是集成Fofa、Quake、Hunter、Shodan、Zoomeye、Chinaz、0.zon e及爱企查的一站式企业信息资产收集、网络资产测绘工具。
0_zone_tool		零零信安api信息系统查询脚本
ThunderSearch	v2.5.1	【支持Fofa、Shodan、Hunter、Zoomeye、Quake网络空间搜索引擎】闪电搜索器；GUI图形化(Mac/Windows)渗透测试信息搜集工具；资产搜集引擎；hw红队工具hvv
ones	v1.0.4	可用于多个网络资产测绘引擎 API 的命令行查询工具

子域名收集

项目名称	版本	项目描述
ksubdomain	v1.9.5	Subdomain enumeration tool, asynchronous dns packets, use pcap to scan 1600,000 subdomains in 1 second
LayerDomainFinder	3	Layer子域名挖掘机
github-subdomains	v1.2.2	Find subdomains on GitHub.
ct	v1.0.9	简单易用的域名爆破工具
ksubdomain	v0.7	无状态子域名爆破工具
LangSrcCurise		SRC子域名资产监控
subDomainsBrute	v1.4	A fast sub domain brute tool for pentesters
subfinder	v2.6.3	Fast passive subdomain enumeration tool.
OneForAll	v0.4.5	OneForAll是一款功能强大的子域收集工具
dnsub	v2.1	dnsub一款好用且强大的子域名扫描工具

自动化信息收集

项目名称	版本	项目描述
ShuiZe_0x727	v1.0	信息收集自动化工具
AnScan		AnScan是一款集合信息收集、分布式漏洞扫描、漏洞POC管理等为一体的红队扫描工具
linglong		一款甲方资产巡航扫描系统。系统定位是发现资产，进行端口爆破。帮助企业更快发现弱口令问题。主要功能包括: 资产探测、端口爆破、定时任务、管理后台识别、报表展示
slime		Slime是一个组合众多优秀安全工具的漏扫软件，它将目光集中在安全工具的组合上，而不是自己实现漏扫的某一流程。
vulcat	v2.0.0	vulcat可用于扫描Web端常见的CVE、CNVD等编号的漏洞，发现漏洞时会返回Payload信息。部分漏洞还支持命令行交互模式，可以持续利用漏洞
bayonet	v1.1	bayonet是一款src资产管理系统，从子域名、端口服务、漏洞、爬虫等一体化的资产管理系统
GoScan		GoScan是采用Golang语言编写的一款分布式综合资产管理系统，适合红队、SRC等使用
Watchdog		Watchdog是bayonet修改版，重新优化了数据库及web及扫描程序,加入多节点
MagiCude	v2.1	分布式端口（漏洞）扫描、资产安全管理、实时威胁监控与通知、高效漏洞闭环、漏洞wiki、邮件报告通知、poc框架
nemo_go	v2.10.3	Nemo是用来进行自动化信息收集的一个简单平台，通过集成常用的信息收集工具和技术，实现对内网及互联网资产信息的自动收集，提高隐患排查和渗透测试的工作效率。
fuxi		Penetration Testing Platform
Sec-Tools		🍉一款基于Python-Django的多功能Web安全渗透测试工具，包含漏洞扫描，端口扫描，指纹识别，目录扫描，旁站扫描，域名扫描等功能。
AppInfoScanner	V1.0.9_ Releases	一款适用于以HW行动/红队/渗透测试团队为场景的移动端(Android、iO S、WEB、H5、静态网站)信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、指纹信息、状态信息等。
Komo		🚀Komo, a comprehensive asset collection and vulnerability sca nning tool. Komo 一个综合资产收集和漏洞扫描工具，集成了20余款工具，通过多种方式对子域进行获取，收集域名邮箱，进行存活探测，域名指纹识别，域名反查ip，ip端口扫描，web服务链接爬取并发送给xray，对web服务进行P
mscan		方便快捷是这款扫描器的优点，能随意修改增加模块。目前的版本功能如下：支持子域名收集、POC批量验证、目录扫描、检测CDN、域名转IP、主机扫描、过滤重复、检测HTTP状态、压缩程序、XRAY扫描。
H		H是一款强大的资产收集管理平台
sec-admin		分布式资产安全扫描核心管理系统(弱口令扫描，漏洞扫描)
linbing	v3.0	本系统是对Web中间件和Web框架进行自动化渗透的一个系统,根据扫描选项去自动化收集资产,然后进行POC扫描,POC扫描时会根据指纹选择POC 插件去扫描,POC插件扫描用异步方式扫描.前端采用vue技术,后端采用pyt hon fastapi.
Tide		目前实现了网络空间资产探测、指纹检索、漏洞检测、漏洞全生命周期管理、poc定向检测、暗链检测、挂马监测、敏感字检测、DNS监测、网站可用性监测、漏洞库管理、安全预警等等~
ARL	v2.6	ARL(Asset Reconnaissance Lighthouse)资产侦察灯塔系统旨在快速侦察与目标关联的互联网资产，构建基础资产信息库。协助甲方安全团队或者渗透测试人员有效侦察和检索资产，发现存在的薄弱点和攻击面。
DBJ		大宝剑-边界资产梳理工具（红队、蓝队、企业组织架构、子域名、Web 资产梳理、Web指纹识别、ICON_Hash资产匹配）
Vulcan		VulCan资产管理系统
X-Marshal		Marshal-EASM
WebScan		正在写的一个资产管理和扫描相结合的分布式扫描器
Voyager		一个安全工具集合平台，用来提高乙方安全人员的工作效率，请勿用于非法项目
rengine	v2.0.2	reNgine is an automated reconnaissance framework for web appli cations with a focus on highly configurable streamlined recon p rocess via Engines, recon data correlation and organiza
heartsk_community	LOWBUG@ Latest	Hearts K-企业资产发现与脆弱性检查工具，自动化资产信息收集与漏洞扫描
xunfeng	v0.1.1	巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。
Autoscanner	v1.2.1	输入域名>爆破子域名>扫描子域名端口>发现扫描web服务>集成报告的全流程全自动扫描器。集成oneforall、masscan、nmap、dirsearch、cra wlergo、xray等工具，另支持cdn识别、网页截图、站点定位；动态识别域名并添加功能、工具超时中断等

综合

项目名称	版本	项目描述
TScan		TScan 提供了CMS指纹识别、端口扫描、旁站信息、信息泄漏等功能，期许在最短的时间辅助安全人员在渗透前做好充分的信息搜集
AssetsHunter		资产狩猎框架-AssetsHunter，信息收集是一项艺术~
dismap	v0.4	Asset discovery and identification tools 快速识别 Web 指纹信息，定位资产类型。辅助红队快速定位目标资产信息，辅助蓝队发现疑似脆弱点

云安全

K8S基线核查

项目名称	版本	项目描述
kube-bench	v0.6.19	Checks whether Kubernetes is deployed according to security be st practices as defined in the CIS Kubernetes Benchmark

K8S漏洞扫描

项目名称	版本	项目描述
kube-hunter	v0.6.8	Hunt for security weaknesses in Kubernetes clusters

容器安全检测工具

项目名称	版本	项目描述
veinmind-tools	v2.1.5	veinmind-tools 是由长亭科技自研，基于 veinmind-sdk 打造的容器安全工具集

容器安全扫描

项目名称	版本	项目描述
trivy	v0.48.0	Find vulnerabilities, misconfigurations, secrets, SBOM in cont ainers, Kubernetes, code repositories, clouds and more

容器镜像扫描

项目名称	版本	项目描述
grype	v0.73.4	A vulnerability scanner for container images and filesystems
syft	v0.98.0	CLI tool and library for generating a Software Bill of Materia ls from container images and filesystems

容器漏洞分析工具

项目名称	版本	项目描述
clair	v4.7.2	Vulnerability Static Analysis for Containers

容器漏洞利用工具

项目名称	版本	项目描述
CDK	v1.5.2	📦 Make security testing of K8s, Docker, and Containerd easier .

容器逃逸检测工具

项目名称	版本	项目描述
container-escape- check	v0.3	docker container escape check

云原生安全平台

项目名称	版本	项目描述
neuvector	v5.2.4
ThunderCloud		Cloud Exploit Framework
containerd	v1.7.11	An open and reliable container runtime

云原生攻防靶场

项目名称	版本	项目描述
metarget	v0.9.1	Metarget is a framework providing automatic constructions of v ulnerable infrastructures.

蓝队

安全建设

Web应用防火墙

项目名称	版本	项目描述
safeline	v3.15.3	一款足够简单、足够好用、足够强的免费 WAF。基于业界领先的语义引擎检测技术，作为反向代理接入，保护你的网站不受黑客攻击。
openstar		lua waf,nginx+lua,openresty,luajit,waf+,cdn,nginx

欺骗防御

项目名称	版本	项目描述
mysql-fake-server	0.0.4	MySQL Fake Server (纯Java实现，支持GUI版和命令行版，提供Docker file，支持多种常见JDBC利用)
MysqlT	v1.0	伪造Myslq服务端,并利用Mysql逻辑漏洞来获取客户端的任意文件反击攻击者
WhetherMysqlSham	v1.0	检测目标Mysql数据库是不是蜜罐
Juggler		A system that may trick hackers. 针对黑客的拟态欺骗系统。
DecoyMini	v2.0.66 91	🐝 A highly scalable, safe, free enterprise honeypots 一款高可扩展、安全、免费的企业级蜜罐系统
MySQL_Fake_Server		MySQL Fake Server use to help MySQL Client File Reading and JD BC Client Java Deserialize
Ehoney	v3.0.0	安全、快捷、高交互、企业级的蜜罐管理系统，护网；支持多种协议蜜罐、蜜签、诱饵等功能。A safe, fast, highly interactive and enter prise level honeypot management system, supports multiple proto col honeypots, honeytokens, baits
MoAn_Honey_Pot_Ur ls		X安蜜罐用的一些存在JSonp劫持的API
HFish		安全、可靠、简单、免费的企业级蜜罐
conpot	Release _0.6.0	ICS/SCADA honeypot
CS_fakesubmit		一个可以伪装上线Cobaltstrike的脚本
ide-honeypot		一款针对于IDE的反制蜜罐 IDE-honeypot

威胁检测

项目名称	版本	项目描述
RmEye	v0.0.4	戎码之眼是一个window上的基于att&ck模型的威胁监控工具.有效检测常见的未知威胁与已知威胁.防守方的利剑

主机入侵防御

项目名称	版本	项目描述
iDefender	2.9.0	iDefender（冰盾 - 终端主动防御系统）

主机入侵检测

项目名称	版本	项目描述
Elkeid	rasp-v2 .2.1.4-s canclass	Elkeid is an open source solution that can meet the security r equirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's int
Hades		Hades is an cross-platform HIDS with kernel-space data collect ion.
cobaltstrike-suri cata-rules		17条检测cobaltstrike的suricata-ids规则

取证

USB取证

键盘流量

项目名称	版本	项目描述
UsbKbCracker		CTF中常见键盘流量解密脚本
UsbKeyboardDataHa cker		USB键盘流量包取证工具 , 用于恢复用户的击键信息

鼠标流量

项目名称	版本	项目描述
UsbMiceDataHacker		USB鼠标流量包取证工具 , 主要用于绘制鼠标移动以及拖动轨迹

内存取证

项目名称	版本	项目描述
VolatilityPro		一款用于自动化处理内存取证的Python脚本，并提供GUI界面
MemProcFS	v5.8	MemProcFS
volatility3	v2.5.0	Volatility 3.0 development
LinuxVolProfiles	2.0	Volatility Linux Profiles
community		Volatility plugins developed and maintained by the community
profiles		Volatility profiles for Linux and Mac OS X
community3		Volatility3 plugins developed and maintained by the community

网络取证

Shiro流量取证

项目名称	版本	项目描述
SerializationDump er-Shiro		基于SerializationDumper的Shiro Cookie序列化数据解密小工具

冰蝎(Behinder)流量取证

项目名称	版本	项目描述
DecodeSomeJSPWebs hell	v1.2	冰蝎、哥斯拉 jsp webshell通信流量解密器
webshell_detect		webshell_detect

哥斯拉(Godzilla)流量取证

项目名称	版本	项目描述
webshell_detect		webshell_detect

文件取证

图片

png

####### LSB隐写

项目名称	版本	项目描述
steganography		Simple C++ Image Steganography tool to encrypt and hide files insde images using Least-Significant-Bit encoding.
stegpy		Simple steganography program based on the LSB method.
cloacked-pixel		LSB steganography and detection
####### png宽高修复
项目名称	版本	项目描述
:----	:----	:----
Deformed-Image-Re storer	V1.02	自动爆破PNG图片宽高并一键修复工具
####### 截图漏洞
项目名称	版本	项目描述
:----	:----	:----
Acropalypse-Multi -Tool	v1.0.0	Easily detect and restore Acropalypse vulnerable PNG and GIF f iles with simple Python GUI.

盲水印

项目名称	版本	项目描述
BlindWaterMark		盲水印 by python
blind_watermark	0.2.1	Blind&Invisible Watermark ，图片盲水印，提取水印无须原图！
blind-watermark		Watermark added to the frequency domain by Fourier transform
BlindWatermark	v0.0.3	Java 盲水印

其他

项目名称	版本	项目描述
ImageMagick	7.1.1-2 3	🧙‍♂️ ImageMagick 7

综合

项目名称	版本	项目描述
stegsolve	v1.4
ImageStrike	V0.2	ImageStrike是一款用于CTF中图片隐写的综合利用工具

压缩包

CRC32碰撞

项目名称	版本	项目描述
CRC32-Tools	2.2	Easy CRC32 Tools，so easy！！！

ZIP伪加密

项目名称	版本	项目描述
ZipCenOp		ZipCenOp is a Java tool to play with Zip pseudo-encryption.

音频

项目名称	版本	项目描述
audacity	Audacit y-3.4.2	Audio Editor
QSSTV		Receive and transmit images over radio using analog SSTV or di gital DRM
dtmf-decoder		Extract phone numbers from an audio recording of the dial tone s.

应用程序取证

QQ取证

项目名称	版本	项目描述
qq_msg_decode		解码qq聊天数据库

vmware vcenter

项目名称	版本	项目描述
vhost_password_de crypt		vhost password decrypt

vmx加密破解

项目名称	版本	项目描述
pyvmx-cracker		Simple tool to crack VMware VMX encryption passwords

Wifi

项目名称	版本	项目描述
WIFIpass		decrypt all saved WIFI passwords on your PC

浏览器取证

项目名称	版本	项目描述
Browser-cookie-st eal		Python script for steal browser cookies
SharpWeb	v1.2	.NET 2.0 CLR project to retrieve saved browser credentials fro m Google Chrome, Mozilla Firefox and Microsoft Internet Explore r/Edge.
360SafeBrowserget pass	v0.1	这是一个一键辅助抓取360安全浏览器密码的CobaltStrike脚本以及解密小工具，用于节省红队工作量，通过下载浏览器数据库、记录密钥来离线解密浏览器密码。
HackBrowserData	v0.4.4	Decrypt passwords/cookies/history/bookmarks from the browser. 一款可全平台运行的浏览器数据导出解密工具。
BrowserGhost	1	这是一个抓取浏览器密码的工具，后续会添加更多功能
Pillager	AutoBui ld	Pillager是一个适用于后渗透期间的信息收集工具

微信取证

项目名称	版本	项目描述
SharpWxDump		微信客户端取证，可获取用户个人信息(昵称/账号/手机/邮箱/数据库密钥(用来解密聊天记录))；支持获取多用户信息，不定期更新新版本偏移，目前支持所有新版本、正式版本
chatViewTool	BEAT	基于Java实现的图形化微信聊天记录解密查看器
Sharp-dumpkey	1	基于C#实现的获取微信数据库密钥的小工具
GoWxDump	v1.0.12	SharpWxDump的Go语言版。微信客户端取证，获取信息(微信号、手机号、昵称)，微信聊天记录分析(Top N聊天的人、统计聊天最频繁的好友排行、关键词列表搜索等)
PyWxDump	v2.3.11	获取微信账号信息(昵称/账号/手机/邮箱/数据库密钥/wxid)；PC微信数据库读取、解密脚本；聊天记录查看工具；聊天记录导出为html(包含语音图片)。支持多账户信息获取，支持所有微信版本。
WeChatUserDB		GetWeChat DBPassword&&UserInfo(获取PC数据库密码以及相关微信用户信息支持多系统数据库解密)
WeChatMsg	v0.2.8	提取微信聊天记录，将其导出成HTML、Word、CSV文档永久保存，对聊天记录进行分析生成年度聊天报告

向日葵取证

项目名称	版本	项目描述
Sunflower_get_Pas sword		一款针对向日葵的识别码和验证码提取工具

远程软件

项目名称	版本	项目描述
Xdecrypt		Xshell Xftp password decrypt
SharpDPAPI		SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.
SharpDecryptPwd		Windows常用程序密码读取工具：SharpDecryptPwd
SharpXDecrypt	v0.1.4	Xshell全版本密码恢复工具
SharpDBeaver		DBeaver数据库密码解密工具
FinalShell-Decode r	V1.0	FinallShell 密码解密GUI工具
getIntrInfo		收集内部网信息。包括：浏览器书签、密码和浏览历史记录、cookie。 Wifi信息和密码。主机信息。
SharpDecryptPwd		SharpDecryptPwd source, To Decrypt Navicat,Xmanager,Filezilla, Foxmail,WinSCP,etc
SharpDecryptPwd		对密码已保存在 Windwos 系统上的部分程序进行解析,包括：Navicat, TeamViewer,FileZilla,WinSCP,Xmangager系列产品（Xshell,Xftp)。源码：https://github.com/RowTeam/SharpDecryptPwd
TeamViewer		TeamView Get PassWord
FinalShellDecodeP ass		FinalShellDecodePass 加密解密
navicat_password_ decrypt	v2.0	忘记navicat密码时,此工具可以帮您查看密码

主机账号

项目名称	版本	项目描述
fakelogonscreen	1.1	Fake Windows logon screen to steal passwords
win-brute-logon		Crack any Microsoft Windows users password without any privile ge (Guest account included)
mimikatz	2.2.0-2 0220919	A little tool to play with Windows security
goLazagne		Go library for credentials recovery
RdpThief_tools		窃取mstsc中的用户明文凭据
LaZagne	v2.4.5	Credentials recovery project

信安

敏感词

项目名称	版本	项目描述
DangerousSpamWord s		🎶超轻量的中文敏感字、敏感词库，字典词典，超低误识别率，另提供API调用
anti-AD	v4.3	致力于成为中文区命中率最高的广告过滤列表，实现精确的广告屏蔽和隐私保护。anti-AD现已支持AdGuardHome，dnsmasq， Surge，Pi-Hole， smartdns等网络组件。完全兼容常见的广告过滤工具所支持的各种广告过滤列表格式
sensitive_words		敏感词库整理

应急

Web层面

webshell后门

项目名称	版本	项目描述
		http://www.shelldetector.com/
Webshell_finder		网站木马检测
BackdoorMan		BackdoorMan is a toolkit that helps you find malicious, hidden and suspicious PHP scripts and shells in a chosen destination.
findWebshell		findWebshell是一款基于python开发的webshell检测工具。
kunwu	0.1.0	kunwu是新一代webshell检测引擎，使用了内置了模糊规则、污点分析模拟执行、机器学习三种高效的检测策略
webshell-find-too ls		分析web访问日志以及web目录文件属性，用于根据查找可疑后门文件的相关脚本。
as_scanwebshell		An AntSword's plugin to scan webshell
		https://www.shellpub.com/
java-memshell-sca nner		通过jsp脚本扫描java web Filter/Servlet型内存马

内存马查杀

项目名称	版本	项目描述
shell-analyzer	0.1	Java内存马查杀GUI工具，实时动态分析，支持本地和远程查杀
arthas	arthas- all-3.7. 1	Alibaba Java Diagnostic Tool Arthas/Alibaba Java诊断利器Arthas
DuckMemoryScan		检测绝大部分所谓的内存免杀马
copagent		java memory web shell extracting tool
aLIEz		杀内存马的工具，欢迎code review，提出更好的意见
ASP.NET-Memshell- Scanner		asp.net内存马检测工具

网络层面

IP信息

项目名称	版本	项目描述
china-operator-ip		**运营商IPv4/IPv6地址库-每日更新
GeoIP2-CN		小巧精悍、准确、实用 GeoIP2 数据库

威胁情报

IP分析

项目名称	版本	项目描述
ARTIF	1.0	An advanced real time threat intelligence framework to identif y threats and malicious web traffic on the basis of IP reputati on and historical data.
tig	v0.5.4	Threat Intelligence Gathering 威胁情报收集，旨在提高蓝队拿到攻击 IP 后对其进行威胁情报信息收集的效率。

暗网监测

项目名称	版本	项目描述
DarkNet_ChineseTr ading		🚇暗网中文网监控爬虫(DEEPMIX)

钓鱼监测

项目名称	版本	项目描述
phishing_catcher		Phishing catcher using Certstream

系统层面

DLL劫持

项目名称	版本	项目描述
DLLSpy	V1	DLL Hijacking Detection Tool

Linux应急工具

项目名称	版本	项目描述
LinuxCheck	V2.3	Linux应急处置/信息搜集/漏洞检测工具，支持基础配置/网络流量/任务计划/环境变量/用户信息/Services/bash/恶意文件/内核Rootkit/SSH/ Webshell/挖矿文件/挖矿进程/供应链/服务器风险等13类70+项检查
malwoverview	v5.4.2	Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, M
uroboros		A GNU/Linux monitoring and profiling tool focused on single pr ocesses.
GScan		本程序旨在为安全应急响应人员对Linux主机排查时提供便利，实现主机侧Checklist的自动全面化检测，根据检测结果自动数据聚合，进行黑客攻击路径溯源。
whohk
Emergency/blob/ma ster/linux.sh
yingji		应急相关内容积累
		https://rkhunter.sourceforge.net/

Windows应急工具

windows日志分析

项目名称	版本	项目描述
APT-Hunter	V3.0	APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hi dden in the sea of windows event logs to decrease the t
windodws-logs-ana lysis		windows日志一键分析小工具
WELA	v1.0.0	WELA (Windows Event Log Analyzer): The Swiss Army knife for Wi ndows Event Logs! ゑ羅（ウェラ）
		https://www.microsoft.com/en-us/download/details.aspx?id=24659
		https://www.nirsoft.net/utils/full_event_log_view.html

进程监控

项目名称	版本	项目描述
		https://processhacker.sourceforge.io/

内核小工具

项目名称	版本	项目描述
YDArk		X64内核小工具

其他

项目名称	版本	项目描述
		https://docs.microsoft.com/zh-cn/sysinternals/downloads/

信息采集

项目名称	版本	项目描述
FireKylin	v1.4.0	🔥火麒麟-网络安全应急响应工具(系统痕迹采集)Cybersecurity emerg ency response tool.👍👍👍
sysmon-config		Sysmon configuration file template with default high-quality e vent tracing
dfirtriage		Digital forensic acquisition tool for Windows based incident r esponse.
winlog		一款基于go的windows信息收集工具，主要收集目标机器rdp端口、msts c远程连接记录、mstsc密码和安全事件中4624、4625登录事件记录

异常检测

项目名称	版本	项目描述
RmTools		蓝队应急工具

综合

项目名称	版本	项目描述
d-eyes	v1.1.0	D-Eyes为绿盟科技一款检测与响应工具

勒索软件

解密工具

项目名称	版本	项目描述
Decryption-Tools		Decryption-Tools

综合

分析辅助

项目名称	版本	项目描述
BlueTeamTools	BlueTea mToolsV0 .89版本	蓝队分析研判工具箱，功能包括内存马反编译分析、各种代码格式化、网空资产测绘功能、溯源辅助、解密冰蝎流量、解密哥斯拉流量、解密Sh iro/CAS/Log4j2的攻击payload、IP/端口连接分析、各种编码/解码功能、蓝队分析常用网址、java反序列化数据包分析、Java类名搜索、Fofa搜索、Hunter搜索等。

安全检查

基线

项目名称	版本	项目描述
Shell_Script	v0.1	Linux系统的安全，通过脚本对Linux系统进行一键检测和一键加固

开发

Go

其他

项目名称	版本	项目描述
go-pinyin	v0.20.0	汉字转拼音

Python

其他

项目名称	版本	项目描述
python-pinyin	v0.49.0	汉字转拼音(pypinyin)
python-small-exam ples		告别枯燥，致力于打造 Python 实用小例子，更多Python良心教程见 P ython中文网 http://www.zglg.work

正则

项目名称	版本	项目描述
common-regex		🎃 常用正则表达式 - 收集一些在平时项目开发中经常用到的正则表达式。

未分类

项目名称	版本	项目描述
pulumi	v3.94.1	Pulumi - Infrastructure as Code in any programming language. B uild infrastructure intuitively on any cloud using familiar lan guages 🚀
trufflehog	v3.62.1	Find and verify credentials
dnSpy	v6.4.1	Unofficial revival of the well known .NET debugger and assembl y editor, dnSpy
druid	1.2.20	阿里云计算平台DataWorks(https://help.aliyun.com/document_detai l/137663.html) 团队出品，为监控而生的数据库连接池
console	v0.41.0	Simple UI for MinIO Object Storage 🧮
notify	v0.41.0	A dead simple Go library for sending notifications to various messaging services.
code-server	v4.18.0	VS Code in the browser
delve	v1.21.2	Delve is a debugger for the Go programming language.
protections-artif acts		Elastic Security detection content for Endpoint
ruby	v3_2_2	The Ruby Programming Language
jadx	v1.4.7	Dex to Java decompiler
glpi	10.0.10	GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and sof tware auditing.
gotestwaf		An open-source project in Golang to asess different API Securi ty tools and WAF for detection logic and bypasses
yara	v4.3.2	The pattern matching swiss knife
gin	v1.9.1	Gin is a HTTP web framework written in Go (Golang). It feature s a Martini-like API with much better performance -- up to 40 t imes faster. If you need smashing performance, get your
etcd	v3.5.10	Distributed reliable key-value store for the most critical dat a of a distributed system
spring-framework	v6.1.0	Spring Framework
wekan	v7.18	The Open Source kanban (built with Meteor). Keep variable/tabl e/field names camelCase. For translations, only add Pull Reques t changes to wekan/i18n/en.i18n.json , other translatio
StratosphereLinux IPS	v1.0.8	Slips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laborat
nuclei-templates	v9.6.9	Community curated list of templates for the nuclei engine to f ind security vulnerabilities.
pdns		PowerDNS Authoritative, PowerDNS Recursor, dnsdist
compose	v2.23.1	Define and run multi-container applications with Docker
AdGuardHome	v0.107. 41	Network-wide ads & trackers blocking DNS server
tabby	v1.0.20 4	A terminal for a more modern age
jumpserver	v3.9.0	JumpServer 是广受欢迎的开源堡垒机，是符合 4A 规范的专业运维安全审计系统。
harbor	v2.9.1	An open source trusted cloud native registry project that stor es, signs, and scans content.
HikariCP		光 HikariCP・A solid, high-performance, JDBC connection pool a t last.
scrapy	2.11.0	Scrapy, a fast high-level web crawling & scraping framework fo r Python.
falco	0.36.2	Cloud Native Runtime Security
suricata	suricat a-7.0.2	Suricata is a network Intrusion Detection System, Intrusion Pr evention System and Network Security Monitoring engine develope d by the OISF and the Suricata community.
yakit	v1.2.7- sp4	Cyber Security ALL-IN-ONE Platform
pwndbg	2023.07 .17	Exploit Development and Reverse Engineering with GDB Made Easy
aliyun-cli	v3.0.18 8	Alibaba Cloud CLI
Microsoft-Activat ion-Scripts	2.5	A Windows and Office activator using HWID / Ohook / KMS38 / On line KMS activation methods, with a focus on open-source code a nd fewer antivirus detections.
commix	v3.8	Automated All-in-One OS Command Injection Exploitation Tool.
sharry	v1.12.1	Sharry is a self-hosted file sharing web application.
APT_REPORT		Interesting APT Report Collection And Some Special IOC
monkey	v2.3.0	Infection Monkey - An open-source adversary emulation platform
zmap	v3.0.0	ZMap is a fast single packet network scanner designed for Inte rnet-wide network surveys.
Nuitka		Nuitka is a Python compiler written in Python. It's fully comp atible with Python 2.6, 2.7, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10 , and 3.11. You feed it your Python app, it does a lot
masscan	1.3.2	TCP port scanner, spews SYN packets asynchronously, scanning e ntire Internet in under 5 minutes.
dfimage		Reverse-engineer a Dockerfile from a Docker image.
theHarvester	4.4.4	E-mails, subdomains and names Harvester - OSINT
alt-tab-macos	v6.64.0	Windows alt-tab on macOS
phpmyadmin	RELEASE _5_2_1	A web interface for MySQL and MariaDB
sdk-api		Public contributions for win32 API documentation
static-analysis		⚙️ A curated list of static analysis (SAST) tools and linter s for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
terraform	v1.6.4	Terraform enables you to safely and predictably create, change , and improve infrastructure. It is a source-available tool tha t codifies APIs into declarative configuration files th
sslh		Applicative Protocol Multiplexer (e.g. share SSH and HTTPS on the same port)
btop	v1.2.13	A monitor of resources
qrazybox		QR Code Analysis and Recovery Toolkit
fish-shell	3.6.1	The user-friendly command line shell.
rich	v13.7.0	Rich is a Python library for rich text and beautiful formattin g in the terminal.
rundeck	v4.17.3	Enable Self-Service Operations: Give specific users access to your existing tools, services, and scripts
pyscript	2023.11 .1	Home Page: https://pyscript.net Examples: https://pyscript.net /examples
LogonTracer	v1.6.1	Investigate malicious Windows logon by visualizing and analyzi ng Windows event log
QEMU		Official QEMU mirror. Please see https://www.qemu.org/contribu te/ for how to submit changes to QEMU. Pull Requests are ignore d. Please only use release tarballs from the QEMU websi
CotEditor	4.6.5	Lightweight Plain-Text Editor for macOS
cas	v6.6.13	Apereo CAS - Identity & Single Sign On for all earthlings and beyond.
krbrelayx		Kerberos unconstrained delegation abuse toolkit
aria2	release -1.37.0	aria2 is a lightweight multi-protocol & multi-source, cross pl atform download utility operated in command-line. It supports H TTP/HTTPS, FTP, SFTP, BitTorrent and Metalink.
upx	v4.2.1	UPX - the Ultimate Packer for eXecutables
CycleTLS		Spoof TLS/JA3 fingerprints in GO and Javascript
PostgresApp	v2.6.8a	The easiest way to get started with PostgreSQL on the Mac
nacos	2.2.3	an easy-to-use dynamic service discovery, configuration and se rvice management platform for building cloud native application s.
photon	5.0-GA	Minimal Linux container host
DongTai	v1.16.0	Dongtai IAST is an open-source Interactive Application Securit y Testing (IAST) tool that enables real-time detection of commo n vulnerabilities in Java applications and third-party
pwcrack-framework	1.21.0	Password Crack Framework
wabt	1.0.34	The WebAssembly Binary Toolkit
garble	v0.10.1	Obfuscate Go builds
onedrive_user_enu m		onedrive user enumeration - pentest tool to enumerate valid o3 65 users
tmux	3.3a	tmux source code
sslscan	2.1.2	sslscan tests SSL/TLS enabled services to discover supported c ipher suites
nmap		Nmap - the Network Mapper. Github mirror of official SVN repos itory.
CSS-Exchange	v23.11. 14.1759	Exchange Server support tools and scripts
TREVORspray		TREVORspray is a modular password sprayer with threading, clev er proxying, loot modules, and more!
broot	v1.28.1	A new way to see and navigate directory trees : https://dystro y.org/broot
dnscrypt-proxy-co nfig
mitmproxy	10.1.5	An interactive TLS-capable intercepting HTTP proxy for penetra tion testers and software developers.
goreleaser	v1.22.1	Deliver Go binaries as fast and easily as possible
f8x	1.6.2	红/蓝队环境自动化部署工具
signature-base	v2.0	YARA signature and IOC database for my scanners and tools
usql	v0.16.0	Universal command-line interface for SQL databases
csprecon	v0.0.8	Discover new target domains using Content Security Policy
yq	v4.35.2	yq is a portable command-line YAML, JSON, XML, CSV, TOML and p roperties processor
gmssl	v3.2.2	a python crypto for sm2/sm3/sm4
python-codext		Python codecs extension featuring CLI tools for encoding/decod ing anything
mapcidr	v1.1.15	Utility program to perform multiple operations for a given sub net/CIDR ranges.
miniforge	23.3.1- 1	A conda-forge distribution.
celery	v5.3.5	Distributed Task Queue (development branch)
Mythic	v3.1.0	A collaborative, multi-platform, red teaming framework
MQTTX	v1.9.6	A Powerful and All-in-One MQTT 5.0 client toolbox for Desktop, CLI and WebSocket.
httpx	v1.3.7	httpx is a fast and multi-purpose HTTP toolkit that allows run ning multiple probes using the retryablehttp library.
coreruleset	v3.3.5	OWASP ModSecurity Core Rule Set (Official Repository)
MoreFind	v1.5.5	一款用于快速导出URL、Domain和IP的小工具
easy-rsa	v3.1.7	easy-rsa - Simple shell based CA utility
PayloadsAllTheThi ngs	3.0	A list of useful payloads and bypass for Web Application Secur ity and Pentest/CTF
ezXSS	4.1	ezXSS is an easy way for penetration testers and bug bounty hu nters to test (blind) Cross Site Scripting.
fzf	0.44.0	🌸 A command-line fuzzy finder
DSInternals	v4.12	Directory Services Internals (DSInternals) PowerShell Module and Framework
gmpy	gmpy2-2 .1.5	General Multi-Precision arithmetic for Python 2.6+/3+ (GMP, MP IR, MPFR, MPC)
gmhelper		基于BC库：国密SM2/SM3/SM4算法简单封装；实现SM2 X509v3证书的签发；实现SM2 pfx证书的签发
gopsutil	v3.23.1 0	psutil for golang
ttyd	1.7.4	Share your terminal over the web
dnsx	v1.1.6	dnsx is a fast and multi-purpose DNS toolkit allow to run mult iple DNS queries of your choice with a list of user-supplied re solvers.
werkzeug	3.0.1	The comprehensive WSGI web application library.
glances	v3.4.0. 2	Glances an Eye on your system. A top/htop alternative for GNU/ Linux, BSD, Mac OS and Windows operating systems.
openrasp	v1.3.7	🔥Open source RASP solution
stratus-red-team	v2.10.0	☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud
jd	v1.7.1	JSON diff and patch
wesng		Windows Exploit Suggester - Next Generation
bandit	1.7.5	Bandit is a tool designed to find common security issues in Py thon code.
ProcDump-for-Linu x	2.2	A Linux version of the ProcDump Sysinternals tool
ioc		Threat Intel IoCs + bits and pieces of dark matter
apollo	v2.1.0	Apollo is a reliable configuration management system suitable for microservice configuration management scenarios.
bat	v0.24.0	A cat(1) clone with wings.
trash-cli		Command line interface to the freedesktop.org trashcan.
psutil		Cross-platform lib for process and system monitoring in Python
croc	v9.6.6	Easily and securely send things from one computer to another : crocodile: 📦
asnmap	v1.0.6	Go CLI and Library for quickly mapping organization network ra nges using ASN information.
FiraCode	6.2	Free monospaced font with programming ligatures
list		The Public Suffix List
alive-progress		A new kind of Progress Bar, with real-time throughput, ETA, an d very cool animations!
shellcheck	v0.9.0	ShellCheck, a static analysis tool for shell scripts
fyne	v2.4.1	Cross platform GUI toolkit in Go inspired by Material Design
filebrowser	v2.26.0	📂 Web File Browser
Damn-Vulnerable-G raphQL-Application	2.1.2	Damn Vulnerable GraphQL Application is an intentionally vulner able implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security.
git-lfs	v3.4.0	Git extension for versioning large files
openvpn-install		OpenVPN road warrior installer for Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora
naxsi	1.3	NAXSI is an open-source, high performance, low rules maintenan ce WAF for NGINX
oss-browser	v1.17.0	OSS Browser 提供类似windows资源管理器功能。用户可以很方便的浏览文件，上传下载文件，支持断点续传等。
LOLBAS		Living Off The Land Binaries And Scripts - (LOLBins and LOLScr ipts)
fd	v8.7.1	A simple, fast and user-friendly alternative to 'find'
node-red	3.1.0	Low-code programming for event-driven applications
soapui	v5.7.2	SoapUI is a free and open source cross-platform functional tes ting solution for APIs and web services.
ModSecurity	v3.0.10	ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is develop ed by Trustwave's SpiderLabs. It has a robust event-bas
sm-crypto		国密算法js版
pdfparser	v2.7.0	PdfParser, a standalone PHP library, provides various tools to extract data from a PDF file.
ILSpy	v8.2	.NET Decompiler with support for PDB generation, ReadyToRun, M etadata (&more) - cross-platform!
grafanaExp	V1.1	A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability (CVE-2021-43798), it can burst plugins / extract secret_key / decrypt data_source info automatic.
color	v1.5.4	🎨 Terminal color rendering library, support 8/16 colors, 256 colors, RGB color rendering output, support Print/Sprintf metho ds, compatible with Windows. GO CLI 控制台颜色渲染工具库，支持1 6色，256
csvtk	v0.28.0	A cross-platform, efficient and practical CSV/TSV toolkit in G olang
interactsh	v1.1.7	An OOB interaction gathering server and client library
fingerprintx	v1.1.11	Standalone utility for service discovery on open ports!
emp3r0r	v1.32.2	Linux/Windows post-exploitation framework made by linux user
color	v1.16.0	Color package for Go (golang)
merlin	v2.0.0	Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
spiderfoot	v4.0	SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
lsassy	v3.1.9	Extract credentials from lsass remotely
weird_proxies		Reverse proxies cheatsheet
Windows11_Hardeni ng		a collection about Windows 11
KaTeX	v0.16.9	Fast math typesetting for the web.
Rubeus	1.6.4	Trying to tame the three-headed dog.
merlin-agent	v2.0.0	Post-exploitation agent for Merlin
telebot	v3.1.0	Telebot is a Telegram bot framework in Go.
gau	v2.2.1	Fetch known URLs from AlienVault's Open Threat Exchange, the W ayback Machine, and Common Crawl.
dnstwist	2023091 8	Domain name permutation engine for detecting homograph phishin g attacks, typo squatting, and brand impersonation
smbmap	v1.9.3. 1	SMBMap is a handy SMB enumeration tool
linux-kernel-expl oitation		A collection of links related to Linux kernel security and exp loitation
ctf-wiki		Come and join us, we need you!
magic-wormhole		get things from one computer to another, safely
focalboard	v7.11.3	Focalboard is an open source, self-hosted alternative to Trell o, Notion, and Asana.
PetitPotam		PoC tool to coerce Windows hosts to authenticate to other mach ines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.
shuji		Reverse engineering JavaScript and CSS sources from sourcemaps
firmadyne		Platform for emulation and dynamic analysis of Linux-based fir mware
scan4all	2.8.7	Official repository vuls Scan: 15000+PoCs; 23 kinds of applica tion password crack; 7000+Web fingerprints; 146 protocols and 9 0000+ rules Port scanning; Fuzz, HW, awesome BugBounty(
retoolkit	2023.10	Reverse Engineer's Toolkit
slopShell		the only php webshell you need.
SCFProxy	v0.2.1	A proxy tool based on cloud function.
al-khaser		Public malware techniques used in the wild: Virtual Machine, E mulation, Debuggers, Sandbox detection.
aliyun-oss-python -sdk	2.18.3	Aliyun OSS SDK for Python
Sentinel	1.8.6	A powerful flow control component enabling reliability, resili ence and monitoring for microservices. (面向云原生微服务的高可用流控防护组件)
fucking-algorithm	plugin	刷算法全靠套路，认准 labuladong 就够了！English version suppor ted! Crack LeetCode, not only how, but also why.
ICS-Security-Tool s		Tools, tips, tricks, and more for exploring ICS Security.
Yara-rules		Collection of private Yara rules.
open-vm-tools	stable- 12.3.5	Official repository of VMware open-vm-tools project
GmSSL	v3.1.1- pr1	支持国密SM2/SM3/SM4/SM9/SSL的密码工具箱
lazydocker	v0.23.1	The lazier way to manage everything docker
pacu	v1.4.2	The AWS exploitation framework, designed for testing the secur ity of Amazon Web Services environments.
scanning
awesome-yara		A curated list of awesome YARA rules, tools, and people.
dontgo403	0.9.4	Tool to bypass 40X response codes.
showdoc	v3.2.2	ShowDoc is a tool greatly applicable for an IT team to share d ocuments online一个非常适合IT团队的在线API文档、技术文档工具
docker_practice	v1.3.0	Learn and understand Docker&Container technologies, with real DevOps practice!
PrivescCheck		Privilege Escalation Enumeration Script for Windows
HijackLibs		Project for tracking publicly disclosed DLL Hijacking opportun ities.
js-md5		A simple MD5 hash function for JavaScript supports UTF-8 encod ing.
server	v0.14.1	Hashtopolis - A Hashcat wrapper for distributed password recov ery
hackerone-reports		Top disclosed reports from HackerOne
FirmAE	v1.0	Towards Large-Scale Emulation of IoT Firmware for Dynamic Anal ysis
websocat	v1.12.0	Command-line client for WebSockets, like netcat (or curl) for ws:// with advanced socat-like functions
ja3		JA3 is a standard for creating SSL client fingerprints in an e asy to produce and shareable way.
uncover	v1.0.7	Quickly discover exposed hosts on the internet using multiple search engines.
S3Scanner	v3.0.4	Scan for misconfigured S3 buckets across S3-compatible APIs!
Nessus_Map		Parse .nessus file(s) and shows output in interactive UI
fail2ban	1.0.2	Daemon to ban hosts that cause multiple authentication errors
SUDO_KILLER		A tool designed to exploit a privilege escalation vulnerabilit y in the sudo program on Unix-like systems. It takes advantage of a specific misconfiguration or flaw in sudo to gain
rdpwrap		RDP Wrapper Library
source-code-pro	2.042R- u/1.062R -i/1.026 R-vf	Monospaced font family for user interface and coding environme nts
cloudflair		🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.
how-to-exit-vim		Below are some simple methods for exiting vim.
can-utils	v2023.0 3	Linux-CAN / SocketCAN user space applications
Empire	v5.7.3	Empire is a post-exploitation and adversary emulation framewor k that is used to aid Red Teams and Penetration Testers.
Starkiller	v2.6.1	Starkiller is a Frontend for PowerShell Empire.
CaptfEncoder	3.1.2	Captfencoder is opensource a rapid cross platform network secu rity tool suite, providing network security related code conver sion, classical cryptography, cryptography, asymmetric
ip2region		Ip2region (2.0 - xdb) is a offline IP address manager framewor k and locator, support billions of data segments, ten microseco nd searching performance. xdb engine implementation for
Havoc		The Havoc Framework.
requests	v1.1.19	用于快速请求HTTP或HTTPS，并支持修改ja3指纹
singularity		A DNS rebinding attack framework.
gobuster	v3.6.0	Directory/File, DNS and VHost busting tool written in Go
pics		File formats explanations, logos redrawing...
cuc-ns		网络安全课本
danted		Fast script for installing & configing Danted--Socks5 Proxy Se rver.
yari		YARI is an interactive debugger for YARA Language.
patator		Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.
libesedb		Library and tools to access the Extensible Storage Engine (ESE ) Database File (EDB) format.
massdns	v1.0.0	A high-performance DNS stub resolver for bulk lookups and reco nnaissance (subdomain enumeration)
lynis	3.0.9	Lynis - Security auditing tool for Linux, macOS, and UNIX-base d systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation
git-vuln-finder	v1.4	Finding potential software vulnerabilities from git commit mes sages
CMWTAT_Digital_Ed ition	2.7.1.0	CloudMoe Windows 10/11 Activation Toolkit get digital license, the best open source Win 10/11 activator in GitHub. GitHub 上最棒的开源 Win10/Win11 数字权利（数字许可证）激活工具！
supervisor		Supervisor process control system for Unix (supervisord)
HOUDINI	v0.2.9	Hundreds of Offensive and Useful Docker Images for Network Int rusion. The name says it all.
pypykatz	0.6.9	Mimikatz implementation in pure Python
jdupes	v1.27.3	A powerful duplicate file finder and an enhanced fork of 'fdup es'.
HexRaysCodeXplore r	2.1	Hex-Rays Decompiler plugin for better code navigation
nali	v0.8.0	An offline tool for querying IP geographic information and CDN provider. 一个查询IP地理信息和CDN服务提供商的离线终端工具.
PPLGuard
webapp-wordlists		This repository contains wordlists for each versions of common web applications and content management systems (CMS). Each ve rsion contains a wordlist of all the files directories
Beta		Beta versions of my software
dsq	v0.23.0	Commandline tool for running SQL queries against JSON, CSV, Ex cel, Parquet, and more.
forbidden	v10.2	Bypass 4xx HTTP response status codes and more. Based on PycUR L and Python Requests.
Thanks-Mirror		整理记录各个包管理器，系统镜像，以及常用软件的好用镜像，Thanks Mirror。走过路过，如觉不错，麻烦点个赞👆🌟
all-about-apikey		Detailed information about API key / OAuth token (Description, Request, Response, Regex, Example)
bkcrack	v1.5.0	Crack legacy zip encryption with Biham and Kocher's known plai ntext attack.
bash-tutorial		Bash 教程
can-i-take-over-x yz		"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.
wait-for	v2.2.4	./wait-for is a script to wait for another service to become a vailable.
trojan	v2.15.3	trojan多用户管理部署程序, 支持web页面管理
gjson		Get JSON values quickly - JSON parser for Go
duf	v0.8.1	Disk Usage/Free Utility - a better 'df' alternative
GetMail		利用NTLM Hash读取Exchange邮件
Diamorphine		LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_6 4 and ARM64)
RedGuard	23.08.2 1	RedGuard is a C2 front flow control tool,Can avoid Blue Teams, AVs,EDRs check.
webshell	v-2021- 01-05	This is a webshell open source project
pingcastle	3.1.0.1	PingCastle - Get Active Directory Security at 80% in 20% of th e time
curl-impersonate	v0.6.0- alpha.1	curl-impersonate: A special build of curl that can impersonate Chrome & Firefox
Halfrost-Field		✍🏻 这里是写博客的地方 —— Halfrost-Field 冰霜之地
awesome-incident- response		A curated list of tools for incident response
gophish	v0.12.1	Open-Source Phishing Toolkit
api-firewall	v0.6.13	Fast and light-weight API proxy firewall for request and respo nse validation by OpenAPI specs.
katana	v1.0.4	A next-generation crawling and spidering framework.
SavvyCAN	V213	QT based cross platform canbus tool
Administrative-di visions-of-China	2.7.0	中华人民共和国行政区划：省级（省份）、地级（城市）、县级（区县）、乡级（乡镇街道）、村级（村委会居委会），**省市区镇村二级三级四级五级联动地址数据。
yongyou_nc_poc
DVSA		a Damn Vulnerable Serverless Application
Responder		Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic
WinPmem	v4.0.rc 1	The multi-platform memory acquisition tool.
how-does-SecureCR T-encrypt-password		Transferred from https://github.com/DoubleLabyrinth/how-does-S ecureCRT-encrypt-password
shodan	v1.0.7	yet another Shodan.io client
nodejsscan	v4.8	nodejsscan is a static security code scanner for Node.js appli cations.
exa	v0.10.1	A modern replacement for ‘ls’.
Archive2	1.3.4
iprange	v1.0.2	计算ip范围,支持 cidr,ip-range 格式的输入
awesome-adb		ADB Usage Complete / ADB 用法大全
IIS-ShortName-Sca nner		latest version of scanners for IIS short filename (8.3) disclo sure vulnerability
CrackMapExec	v5.4.0	A swiss army knife for pentesting networks
sast-scan	v2.1.1	Scan is a free & Open Source DevSecOps tool for performing sta tic analysis based security testing of your applications and it s dependencies. CI and Git friendly.
JsRpc	v1.02	远程调用(rpc)浏览器方法，免去抠代码补环境
hindsight	v2023.0 3	Web browser forensics for Google Chrome/Chromium
crc32	v0.1	CRC32 tools: reverse, undo/rewind, and calculate hashes
fav-up	v0.2	IP lookup by favicon using Shodan
SigFlip		SigFlip is a tool for patching authenticode signed PE files (e xe, dll, sys ..etc) without invalidating or breaking the existi ng signature.
spectre-meltdown- checker	v0.46	Downfall, Zenbleed, ZombieLoad, RIDL, Fallout, Foreshadow, Spe ctre, Meltdown vulnerability/mitigation checker for Linux & BSD
KCon		KCon is a famous Hacker Con powered by Knownsec Team.
Tentacle		Tentacle is a POC vulnerability verification and exploit frame work. It supports free extension of exploits and uses POC scrip ts. It supports calls to zoomeye, fofa, shodan and othe
dwarf2json		convert ELF/DWARF symbol and type information into vol3's inte rmediate JSON
awesome-honeypots		an awesome list of honeypot resources
jaeles	beta-v0 .17.1	The Swiss Army knife for automated Web Application Testing
btrace	v2.2.4	BTrace - a safe, dynamic tracing tool for the Java platform
Freeze	v1.3	Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods
poc		Proof of Concepts
one_gadget	v1.8.1	The best tool for finding one gadget RCE in libc.so.6
tabby	v1.2.0- 3	A CAT called tabby ( Code Analysis Tool )
deepce		Docker Enumeration, Escalation of Privileges and Container Esc apes (DEEPCE)
SecLists	2023.2	SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, c ollected in one place. List types include usernames, pa
dirhunt	v0.9.0	Find web directories without bruteforce
proxify	v0.0.12	A versatile and portable proxy for capturing, manipulating, an d replaying HTTP/HTTPS traffic on the go.
RustScan	2.1.1	🤖 The Modern Port Scanner 🤖
merlin		Cross-platform post-exploitation HTTP Command & Control agent written in golang
tqdm	v4.66.1	⚡ A Fast, Extensible Progress Bar for Python and CLI
teler	v2.0.0- dev.3	Real-time HTTP Intrusion Detection
OpenRedireX		A fuzzer for detecting open redirect vulnerabilities
CrossC2	v3.2	generate CobaltStrike's cross-platform payload
qiling	1.4.6	A True Instrumentable Binary Emulation Framework
msdat		MSDAT: Microsoft SQL Database Attacking Tool
Windows-AD-enviro nment-related		This Repository contains the stuff related to windows Active d irectory environment exploitation
fierce		A DNS reconnaissance tool for locating non-contiguous IP space .
awesome-vehicle-s ecurity		🚗 A curated list of resources for learning about vehicle secu rity and car hacking.
vlmcsd	svn1113	KMS Emulator in C (currently runs on Linux including Android, FreeBSD, Solaris, Minix, Mac OS, iOS, Windows with or without C ygwin)
BountyHunterInChi na		重生之我是赏金猎人系列，分享自己和团队在SRC、项目实战漏洞测试过程中的有趣案例
simplehttpserver	v0.0.6	Go alternative of python SimpleHTTPServer
bettercap	v2.32.0	The Swiss Army knife for 802.11, BLE, IPv4 and IPv6 networks r econnaissance and MITM attacks.
awesome-oscp		A curated list of awesome OSCP resources
sourcemapper		Extract JavaScript source trees from Sourcemap files
s3tk		A security toolkit for Amazon S3
CVE-2020-1472		Test tool for CVE-2020-1472
mquery	v1.4.0	YARA malware query accelerator (web frontend)
knock	5.4.0	Knock Subdomain Scan
zsteg		detect stegano-hidden data in PNG & BMP
PSGumshoe	v2.0
PRET		Printer Exploitation Toolkit - The tool that made dumpster div ing obsolete.
dive	v0.11.0	A tool for exploring each layer in a docker image
clairvoyance	v2.5.3	Obtain GraphQL API schema even if the introspection is disable d
Linux_LPE_eBPF_CV E-2021-3490
SIGRed_RCE_PoC
MX1014	v2.4.0	MX1014 is a flexible, lightweight and fast port scanner.
cloud-service-enu m
cve-2020-0688		cve-2020-0688
stegoVeritas		Yet another Stego Tool
thc-ipv6	v3.8	IPv6 attack toolkit
Penetration-Testi ng-Tools		A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pen testing/IT Security audits purposes.
wisper		A micro library providing Ruby objects with Publish-Subscribe capabilities
PowerUpSQL		PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server
ctf-tools		Some setup scripts for security research tools.
wechat-backup	v1.0.0	微信聊天记录持久化备份本地硬盘，释放手机存储空间。
basecrack	v4.0	Decode All Bases - Base Scheme Decoder
Violation_Pnetest		渗透红线Checklist
weevely3	v4.0.1	Weaponized web shell
awesome-industria l-control-system-s ecurity		A curated list of resources related to Industrial Control Syst em (ICS) security.
windows_exploit_d owser		A simple tool which could be useful to identify the exploits a fflicting a Windows OS
jenv	0.5.6	Manage your Java environment
etl2pcapng	v1.11.0	Utility that converts an .etl file containing a Windows networ k packet capture into .pcapng format.
CVE-2021-21972		CVE-2021-21972 Exploit
kernel-exploit-fa ctory		Linux kernel CVE exploit analysis report and relative debug en vironment. You don't need to compile Linux kernel and configure your environment anymore.
Motrix	v1.8.19	A full-featured download manager.
java-sec-code	v2.0.0	Java web common vulnerabilities and security code which is bas e on springboot and spring security
DS_Store_crawler_ parser		a parser + crawler for .DS_Store files exposed publically
wafw00f	v2.2.0	WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.
shc	4.0.3	Shell script compiler
safety	2.3.5	Safety checks Python dependencies for known security vulnerabi lities and suggests the proper remediations for vulnerabilities detected.
hassh		HASSH is a network fingerprinting standard which can be used t o identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared
ntlmv1-multi		NTLMv1 Multitool
poc-graphql	1.0.0	Research on GraphQL from an AppSec point of view.
OffensiveNotion	v1.5.0	Notion as a platform for offensive operations
proxychains-ng	v4.16	proxychains ng (new generation) - a preloader which hooks call s to sockets in dynamically linked programs and redirects it th rough one or more socks/http proxies. continuation of t
dnsFookup		DNS rebinding toolkit
APIKit	v1.5.1	APIKit：Discovery, Scan and Audit APIs Toolkit All In One.
shadow-tls	v0.2.23	A proxy to expose real tls handshake to the firewall
javaboy-code-samp les		公众号【江南一点雨】文章案例汇总，技术文章请戳这里----->
espanso	v2.1.8	Cross-platform Text Expander written in Rust
chainoffools		A PoC for CVE-2020-0601
xortool		A tool to analyze multi-byte xor cipher
theZoo	v0.60	A repository of LIVE malwares for your own joy and pleasure. t heZoo is a project created to make the possibility of malware a nalysis open and available to the public.
s3reverse	v1.0.1	The format of various s3 buckets is convert in one format. for bugbounty and security testing.
gitls	v1.0.4	🖇 Enumerate git repository URL from list of URL / User / Org. Friendly to pipeline
the-craft-of-self teaching		One has no future if one couldn't teach themself.
hello-world
CVEs		The following is a list of my collected CVE's
ssti-payloads		🎯 Server Side Template Injection Payloads
yaml-payload-for- ruoyi		A memory shell for ruoyi
humre		A human-readable regular expression module for Python.
bypass-403		A simple script just made for self use for bypassing 403
jsrsasign	10.8.5	The 'jsrsasign' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA sign ing/validation, ASN.1, PKCS#1/5/8 private/public key, X
cloudscraper	1.2.68	A Python module to bypass Cloudflare's anti-bot page.
ccat	v1.01	Cisco Config Analysis Tool
KodExplorer	4.51.03	A web based file manager,web IDE / browser based code editor
Pinyin2Hanzi		拼音转汉字，拼音输入法引擎， pin yin -> 拼音
cheetah		a very fast brute force webshell password tool
Girsh	v0.41	Automatically spawn a reverse shell fully interactive for Linu x or Windows victim
htmlq	v0.4.0	Like jq, but for HTML.
sttr	v0.2.18	cross-platform, cli app to perform various operations on strin g
SeeYouCM-Thief
Powershellery		This repo contains Powershell scripts used for general hackery .
proxypool	v0.3.1	Automatically crawls proxy nodes on the public internet, de-du plicates and tests for usability and then provides a list of no des
Homework-of-Pytho n		Python codes of my blog.
jo	1.9	JSON output from a shell
top25-parameter	v1.0.7	For basic researches, top 25 vulnerability parameters that can be used in automation tools or manual recon. 🛡️⚔️🧙
s3-buckets-finder	v1.2.0	Find AWS S3 buckets and test their permissions.
Realtek_switch_ha cking		折腾交换机
HostCollision	HostCol lision-2 .2.8	用于host碰撞而生的小工具,专门检测渗透中需要绑定hosts才能访问的主机或内部系统
Azure-Red-Team		Azure Security Resources and Notes
autotimeliner		Automagically extract forensic timeline from volatile memory d ump
APT_CyberCriminal _Campagin_Collecti ons		APT & CyberCriminal Campaign Collection
nginx-ssl-ja3	v0.0.2	nginx module for SSL/TLS ja3 fingerprint.
GraphQLmap		GraphQLmap is a scripting engine to interact with a graphql en dpoint for pentesting purposes. - Do not use for illegal testin g ;)
donut	v1.0	Generates x86, x64, or AMD64+x86 position-independent shellcod e that loads .NET Assemblies, PE files, and other Windows paylo ads from memory and runs them with parameters
Red-Team-Infrastr ucture-Wiki		Wiki to collect Red Team infrastructure hardening resources
pwn_jenkins		Notes about attacking Jenkins servers
byp4xx		40X/HTTP bypasser in Go. Features: Verb tampering, headers, #b ugbountytips, User-Agents, extensions, default credentials...
exrex		Irregular methods on regular expressions
CVE-2022-2588		exploit for CVE-2022-2588
javascript-malwar e-collection		Collection of almost 40.000 javascript malware samples
alicloud-tools	v1.0.5	阿里云ECS、策略组辅助小工具
ebpfkit-monitor		ebpfkit-monitor is a tool that detects and protects against eB PF powered rootkits
jsencrypt		A zero-dependency Javascript library to perform OpenSSL RSA En cryption, Decryption, and Key Generation.
CVE-2020-0796-PoC		PoC for triggering buffer overflow via CVE-2020-0796
bopscrk	v2.4.5	Generate smart and powerful wordlists
geckodriver	v0.33.0	WebDriver for Firefox
CVE-2018-10933		Spawn to shell without any credentials by using CVE-2018-10933 (LibSSH)
druid_sessions	1.2	获取 alibaba druid 一些 sessions , sql , urls
cloud-native-secu rity-book		《云原生安全：攻防实践与体系构建》资料仓库
onesixtyone	v0.3.4	Fast SNMP Scanner
WaterDragon		WaterDragon:用GithubAction实现代理功能。红队,cve,代理池,隐匿, 攻防,对抗，hackone,src,proxy,CVE-2020,CVE-2021,CVE-2022
SMx		国家商用加密算法 SMx（SM2,SM3,SM4）
shhgit		Ah shhgit! Find secrets in your code. Secrets detection for yo ur GitHub, GitLab and Bitbucket repositories.
apkleaks	v2.6.1	Scanning APK file for URIs, endpoints & secrets.
tsh-go		Tiny SHell Go - An open-source backdoor written in Go
github-search	v2.0.1	A collection of tools to perform searches on GitHub.
CobaltStrikeParse r
antiHoneypot	0.7.2	一个拦截 XSSI & 识别Web蜜罐的Chrome扩展
binwalk	v2.3.4	Firmware Analysis Tool
jira_scan	v0.0.6	A simple remote scanner for Atlassian Jira
OddProxyDemo
anchore-engine		A service that analyzes docker images and scans for vulnerabil ities
EVTX-ATTACK-SAMPL ES		Windows Events Attack Samples
PHP_INCLUDE_TO_SH ELL_CHAR_DICT
reverse-shell		Reverse Shell as a Service
fapro	v0.65	Fake Protocol Server
cs2modrewrite		Convert Cobalt Strike profiles to modrewrite scripts
pspy	v1.2.1	Monitor linux processes without root permissions
wenyan	v0.3.4	文言文編程語言 A programming language for the ancient Chinese.
slipstream		NAT Slipstreaming allows an attacker to remotely access any TC P/UDP services bound to a victim machine, bypassing the victim ’s NAT/firewall, just by anyone on the victim's network
TLS-poison
flask-session-coo kie-manager	v1.2.1. 1	🍪 Flask Session Cookie Decoder/Encoder
security-bucket-b rigade
hashcrack		Guesses hash types, picks some sensible dictionaries and rules for hashcat
CVE-2021-27850_PO C		A Proof of concept for CVE-2021-27850 affecting Apache Tapestr y and leading to unauthencticated remote code execution.
exploits
kerberoast
fi6s		IPv6 network scanner designed to be fast
exploit-CVE-2017- 7494		SambaCry exploit and vulnerable container (CVE-2017-7494)
Arjun	2.2.1	HTTP parameter discovery suite.
usbrply		Replay USB messages from Wireshark (.cap) files
javaweb-vuln		RASP测试靶场
Pentest101		一些关于渗透测试的Tips
jasypt-spring-boo t	jasypt- spring-b oot-pare nt-3.0.5	Jasypt integration for Spring boot
CC-attack	v3.7.1	Using Socks4/5 or http proxies to make a multithreading Http-f lood/Https-flood (cc) attack.
marshalsec
base58		Base58 and Base58Check implementation compatible with what is used by the bitcoin network.
LiME	v1.9.1	LiME (formerly DMD) is a Loadable Kernel Module (LKM), which a llows the acquisition of volatile memory from Linux and Linux-b ased devices, such as those powered by Android. The too
git-tips		Git的奇技淫巧
CVE-2017-1000486		Primefaces <= 5.2.21, 5.3.8 or 6.0 - Remote Code Execution Exp loit
sec-dog	v1.0.4
MSOLSpray		A password spraying tool for Microsoft Online accounts (Azure/ O365). The script logs if a user cred is valid, if MFA is enabl ed on the account, if a tenant doesn't exist, if a user
TerraformGoat	0.0.7	TerraformGoat is HXSecurity research lab's "Vulnerable by Desi gn" multi cloud deployment tool.
Chinese-Names-Cor pus	v2.2	中文人名语料库。人名生成器。中文姓名,姓氏,名字,称呼,日本人名, 翻译人名,英文人名。可用于中文分词、人名实体识别。
toppwdhash		常见密码哈希离线查询工具 , 包含算法类型'md5', 'md5x2', 'md5x3' ,'sha1', 'ntlm', 'mysql', 'mysql5','md5_sha1', 'sha1_sha1', 'sh a1_md5', 'md5_base64','md5_middle','base64_md5', 'md5_sha256', 'sha256','
UsnJrnl2Csv	v1.0.0. 24	Parser for $UsnJrnl on NTFS
sliver-gui	v0.0.9	A Sliver GUI Client
HTTP-Smuggling-La b		Use HTTP Smuggling Lab to learn HTTP Smuggling.
ProxyNotShell-PoC
as_bypass_php_dis able_functions		antsword bypass PHP disable_functions
wix3	wix3112 rtm	WiX Toolset v3.x
exploitdb-bin-spl oits		The legacy Exploit Database repository - New repo located at h ttps://gitlab.com/exploit-database/exploitdb-bin-sploits
SSRF-Testing		SSRF (Server Side Request Forgery) testing resources
tools		Security and Hacking Tools, Exploits, Proof of Concepts, Shell codes, Scripts.
csdroid		cs手机版的源码，此处不放源jar包，自行添加编译
CVE-2022-3602
anti-portscan		使用 iptables 防止端口扫描
Extracted_WD_VDM		Windows Defender VDM lua collections
firmware-mod-kit		Automatically exported from code.google.com/p/firmware-mod-kit
siphon	v0.0.2	⚗️ Intercept stdin/stdout/stderr for any process
NGLite	V1.0.01	A major platform RAT Tool based by Blockchain/P2P.Now support Windows/Linux/MacOS
katoolin		Automatically install all Kali linux tools
xerosploit	v1.0	Efficient and advanced man in the middle framework
ProxyVulns		[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyOracle] CVE-2021-31195 & CVE-2021-31196 Exp loit Chains. [ProxyShell] CVE-2021-34473 & CVE-2021-345
Exchange2domain		CVE-2018-8581
MailSniper		MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms ( passwords, insider intel, network architecture informat
qqwry2mmdb	2023041 9	为 Wireshark 能使用纯真网络 IP 数据库(QQwry)而提供的格式转换工具
telegram-bot-api	v5.5.1	Golang bindings for the Telegram Bot API
SysmonEnte
HandleKatz		PIC lsass dumper using cloned handles
Zoinks		Manage Engine Decrypter
jwtcat		A CPU-based JSON Web Token (JWT) cracker and - to some extent - scanner.
IFaultrepElevated DataCollectionUAC
Veil	3.1.14	Veil 3.1.X (Check version info in Veil at runtime)
CVE-2022-40684		A proof of concept exploit for CVE-2022-40684 affecting Fortin et FortiOS, FortiProxy, and FortiSwitchManager
how-does-navicat- encrypt-password		Transferred from https://github.com/DoubleLabyrinth/how-does-n avicat-encrypt-password
bash-insulter		Insults the user when typing wrong command
Digital-Privacy		Information Protection & OSINT resources
CVE-2022-2992		Authenticated Remote Command Execution in Gitlab via GitHub im port
Pentest-Windows		Windows internals and exploitation tricks
mimipenguin	2.0-rel ease	A tool to dump the login password from the current linux user
hackergame2021-wr iteups		**科学技术大学第八届信息安全大赛的官方与非官方题解
Socks5		Socks5代理服务器搭建脚本/Socks5 shortcut creation script
poodle-PoC		🐩 Poodle (Padding Oracle On Downgraded Legacy Encryptio n) attack CVE-2014-3566 🐩
monomorph	v1.0	MD5-Monomorphic Shellcode Packer - all payloads have the same MD5 hash
ipv6toolkit		SI6 Networks' IPv6 Toolkit
TaskSchedulerMisc		Misc TaskScheduler Plays
poc_and_exp		搜集的或者自己写的poc或者exp
CVE-2022-39197-pa tch	patch-0 .2	CVE-2022-39197 漏洞补丁. CVE-2022-39197 Vulnerability Patch.
Security-PPT		Security-related Slide Presentation & Security Research Report （大安全各领域各公司各会议分享的PPT以及各类安全研究报告）
network-fingerpri nt	v0.0.1	A fingerprint generation helper for nuclei network templates
powerline-shell		A beautiful and useful prompt for your shell
gokart	v0.5.1	A static analysis tool for securing Go code
crlfuzz	v1.4.1	A fast tool to scan CRLF vulnerability written in Go
choose	v1.3.4	A human-friendly and fast alternative to cut and (sometimes) a wk
go-dork	v1.0.2	The fastest dork scanner written in Go.
CVE-2022-34918		CVE-2022-34918 netfilter nf_tables 本地提权 POC
go-mimikatz		A wrapper around a pre-compiled version of the Mimikatz execut able for the purpose of anti-virus evasion.
imcat		Show any image in a terminal window.
CVE-2022-36804		A real exploit for BitBucket RCE CVE-2022-36804
See-SURF	v2.0	Python based scanner to find potential SSRF parameters
CVE-2022-34918-LP E-PoC
fireprox		AWS API Gateway management tool for creating on the fly HTTP p ass-through proxies for unique IP rotation
iscsicpl_bypassUA C	v1.0	UAC bypass for x64 Windows 7 - 11（无弹窗版）
package-manager-p roxy-settings		记录各个包管理器代理设置坑点。
taskcafe	0.3.2	An open source project management tool with Kanban boards
Suborner	1.0.1
gmapsapiscanner
LOG-HUB		日志分析库,nuclei 的另一种用法
Jira-Lens	v1.0.2	Fast and customizable vulnerability scanner For JIRA written i n Python
nps-auth-bypass		nps认证绕过利用工具，CVE-2022-40494，使用此工具可在浏览器访问w eb控制端后台页面，或者批量获取socks5和http代理
Invoke-x64dbg-loa ddll		调用x64dbg中的loadll.exe白加黑示例代码
Lsass-Shtinkering
phantom-attack		POC for Phantom Attack
ini	v1.67.0	Package ini provides INI file read and write functionality in Go
WTSRM		WTSRM
Loki-bot		多功能Windows机器运维管理工具
ctop	v0.7.7	Top-like interface for container metrics
7z2hashcat	1.9	extract information from password-protected .7z archives (and .sfx files) such that you can crack these "hashes" with hashcat
LinuxEelvation		Linux Eelvation(持续更新)
get_AV		Windows杀软在线对比辅助
PPLdump		Dump the memory of a PPL with a userland exploit
DahuaConsole		Dahua Console, access internal debug console and/or other rese arched functions in Dahua devices. Feel free to contribute in t his project.
unfurl	v0.4.3	Pull out bits of URLs provided on stdin
tomorrow-theme		Tomorrow Theme
jarm_randomizer		This tool was open sourced as part of JARM Randomizer: Evading JARM Fingerprinting for HiTB Amsterdam 2021.
XORpass		Encoder to bypass WAF filters using XOR operations.
jira-mobile-ssrf- exploit		Exploit code for Jira Mobile Rest Plugin SSRF (CVE-2022-26135)
csp_security_mist akes		This repo has been replaced by https://www.cloudvulndb.org
KillDefender		A small (Edited) POC to make defender useless by removing its token privileges and lowering the token integrity
writeups
qsreplace	v0.0.3	Accept URLs on stdin, replace all query string values with a u ser-supplied value
DFSCoerce
ExtractedDefender
ADFSRelay	v1.0	Proof of Concept Utilities Developed to Research NTLM Relaying Attacks Targeting ADFS
PwnKit		Self-contained exploit for CVE-2021-4034 - Pkexec Local Privil ege Escalation
APTSimulator	v0.9.4	A toolset to make a system look as if it was the victim of an APT attack
CTF_web		a project aim to collect CTF web practices .
blueming	2022080 20633	备份文件扫描，并自动进行下载
cobalt-arsenal		My collection of battle-tested Aggressor Scripts for Cobalt St rike 4.0+
DirtyPipe-Android	1.0.3	Dirty Pipe root exploit for Android (Pixel 6)
hikvision-decrypt er	v1.0	A simple cross platform program written in C++ used for decryp ting the configuration files created by Hikvision Security Came ras. Successor to my hikvision-xor-decrypter
PostConfluence	v1.0	哥斯拉Confluence后渗透插件 MakeToken SearchPage ListAllUser Ad dAdminUser ListAllPage ........
face_recognition	v1.2.2	The world's simplest facial recognition api for Python and the command line
httprobe	v0.2	Take a list of domains and probe for working HTTP and HTTPS se rvers
test	ysoseri al-0.0.6 -SNAPSHO T	just test
client-side-proto type-pollution		Prototype Pollution and useful Script Gadgets
fastjson-blacklis t
dirble	v1.4.2	Fast directory scanning and scraping tool
PoC-CVE-2022-3019 0		POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina
knm		鼠标键盘流量包取证
spring-boot-start er-swagger	2.0.2.R ELEASE	自制spring boot starter for swagger 2.x，来试试吧，很好用哦~
msdt-follina		Codebase to generate an msdt-follina payload
CVE-2022-22972
CVE-2022-0540-RCE		Atlassian Jira Seraph Authentication Bypass RCE（CVE-2022-0540 ）
CVE-2022-0185		CVE-2022-0185 POC and Docker and Analysis write up
BlueLotus_XSSRece iver
ModSecurity-nginx	v1.0.3	ModSecurity v3 Nginx Connector
fuzzdb		Automatically exported from code.google.com/p/fuzzdb
ip2domain	ip2doma in_v0.2	批量查询ip对应域名及百度权重、备案信息；ip反查域名；ip查备案信息；资产归属查询；百度权重查询
SharPyShell	v1.3.0	SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications
CVE-2021-22555-Pi peVersion		CVE-2021-22555 exploit rewritten with pipe primitive
WerTrigger		Weaponizing for privileged file writes bugs with windows probl em reporting
Bug-Report
swagger2markup	v1.3.4	A Swagger to AsciiDoc or Markdown converter to simplify the ge neration of an up-to-date RESTful API documentation by combinin g documentation that’s been hand-written with auto-gene
check-virtual-mac hine
satellite	v0.0.4	easy-to-use payload hosting
AllatoriCrack	7.6.2	破解 Java 混淆工具 Allatori
BaoTa		宝塔Linux面板 - 简单好用的服务器运维面板
zscan	v2.0.1	Zscan a scan blasting tool set
sec-interview		信息安全面试题汇总
gron	v0.7.1	Make JSON greppable!
rules		Repository of yara rules
CobaltNotion		A spin-off research project. Cobalt Strike x Notion collab 202 2
aliyun-accesskey- Tools	v1.3	阿里云accesskey利用工具
zipcreater	v0.0.2	ZipCreater主要应用于跨目录的文件上传漏洞的利用，它能够快速进行压缩包生成。
Spring4Shell-POC		Dockerized Spring4Shell (CVE-2022-22965) PoC application and e xploit
waybackurls	v0.1.0	Fetch all the URLs that the Wayback Machine knows about for a domain
CVE-2022-25636-Pi peVersion		CVE-2022-25636 exploit rewritten with pipe primitive
CVE-2022-0185-Pip eVersion		CVE-2022-0185 exploit rewritten with pipe primitive
SpringShell		Spring4Shell - Spring Core RCE - CVE-2022-22965
VindicateTool		LLMNR/NBNS/mDNS Spoofing Detection Toolkit
Spring4Shell-POC		This is a dockerized application that is vulnerable to the Spr ing4Shell vulnerability (CVE-2022-22965).
pydictor	v2.0.5	A powerful and useful hacker dictionary builder for a brute-fo rce attack
kernel-exploits		My proof-of-concept exploits for the Linux kernel
hetty	v0.7.0	An HTTP toolkit for security research.
AttackDetection		Attack Detection
CVE-2022-0778		Proof of concept for CVE-2022-0778, which triggers an infinite loop in parsing X.509 certificates due to a bug in BN_mod_sqrt
writeups
CVE-2022-27666		Exploit for CVE-2022-27666
rsatool		rsatool can be used to calculate RSA and RSA-CRT parameters
vulnerability-lis t		在渗透测试中快速检测常见中间件、组件的高危漏洞。
XSStrike	3.1.5	Most advanced XSS scanner.
GBByPass		冰蝎哥斯拉 WebShell bypass
anew	v0.1.1	A tool for adding new lines to files, skipping duplicates
Karta	v2.1.0	Karta - source code assisted fast binary matching plugin for I DA
dompdf-rce		RCE exploit for dompdf
big_screen		数据大屏可视化
vcenter_saml_logi n		A tool to extract the IdP cert from vCenter backups and log in as Administrator
Markdown-XSS-Payl oads		XSS payloads for exploiting Markdown syntax
CVE-2022-0847-Dir tyPipe-Exploit		A root exploit for CVE-2022-0847 (Dirty Pipe)
AWSBucketDump		Security Tool to Look For Interesting Files in S3 Buckets
CVE-2022-25636		CVE-2022-25636
3vilGu4rd	3vilGu4 rd-V0.2	This is a daemon process which make a programe runing all time .
Spring-Cloud-Gate way-CVE-2022-22947		CVE-2022-22947
cidr-merger	v1.1.3	A simple command line tool to merge ip/ip cidr/ip range, suppo rts IPv4/IPv6
proxylogscan	v0.0.2	A fast tool to mass scan for a vulnerability on Microsoft Exch ange Server that allows an attacker bypassing the authenticatio n and impersonating as the admin (CVE-2021-26855).
MQTT-Explorer	v0.3.5	An all-round MQTT client that provides a structured topic over view
cve-2022-23131		cve-2022-23131 zabbix-saml-bypass-exp
jQuery-with-XSS		jQuery with XSS, Testing and Secure Version
CNVD-2022-10270-L PE	2022-02 -24	基于向日葵RCE的本地权限提升，无需指定端口
mitm6	v0.3.0	pwning IPv4 via IPv6
WindowsElevation		Windows Elevation(持续更新)
sunlogin_rce	new	向日葵 RCE
Sylas	beta	数据库综合利用工具
My-Shodan-Scripts		Collection of Scripts for shodan searching stuff.
KillDefender		A small POC to make defender useless by removing its token pri vileges and lowering the token integrity
403-fuzz		针对 403 页面的 fuzz 脚本
CollaboratorPlusP lus	v1.0.2
ripple20		A Zeek package for the passive detection of "Ripple20" vulnera bilities in the Treck TCP/IP stack.
CVE-2019-11539		Exploit for the Post-Auth RCE vulnerability in Pulse Secure Co nnect
patching	v0.1.2	An Interactive Binary Patching Plugin for IDA Pro
CVE-2021-4034-NoG CC	v4.0	CVE-2021-4034简单优化，以应对没有安装gcc和make的目标环境
BeRoot	1.0.1	Privilege Escalation Project - Windows / Linux / Mac
Cloud-Pentesting		This repository is in progress, it will keep updating as I com e across to new learning materials. Feel free to contribute.
trevorc2		TrevorC2 is a legitimate website (browsable) that tunnels clie nt/server communications for covert command execution.
netview	latest	Netview enumerates systems using WinAPI calls
CVE-2021-4034		CVE-2021-4034 1day
CVE-2021-4034		polkit pkexec Local Privilege Vulnerability to Add custom comm ands
CVE-2022-21882		win32k LPE
ja3box		extract ja3(s) when sniffing or from a pcap.
CVE-2021-4034		PoC for PwnKit: Local Privilege Escalation Vulnerability in po lkit’s pkexec (CVE-2021-4034)
Libra		Libra [ 天秤座 ]
social-engineer-t oolkit		The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
SuperMem		A python script developed to process Windows memory images bas ed on triage type.
exploits		Pwn stuff.
JSP-Webshells		Collect JSP webshell of various implementation methods. 收集JS P Webshell的各种姿势
CVE-2021-22205		GitLab CE/EE Preauth RCE using ExifTool
CVE-2021-21985_Po C
ShadowSteal		Pure Nim implementation for exploiting CVE-2021-36934, the Ser iousSAM local privilege escalation
gmsm	v1.4.1	GM SM2/3/4 library based on Golang (基于Go语言的国密SM2/SM3/SM 4算法库)
SMTP-NC	v0.1.1	SMTP Netcat , test SMTP protocol
domain_screen		站点批量截图
go-shodan	v2.0.4	Shodan API client
linux-exploit-sug gester-2		Next-Generation Linux Kernel Exploit Suggester
MyTools
Blind-SSRF		Nuclei Templates to reproduce Cracking the lens's Research
shiftleft-go-demo
CVE-2019-5736-PoC		PoC for CVE-2019-5736
Spring-Boot-Vulne rability
blind-ssrf-chains		An exhaustive list of all the possible ways you can chain your Blind SSRF vulnerability
ShadowCoerce		MS-FSRVP coercion abuse PoC
SimpleDnsCrypt	0.7.1	A simple management tool for dnscrypt-proxy
rdesktop	v1.9.0	🚨 rdesktop is in need of a new maintainter. Please see the ho me page for more details. 🚨
ZhouYu		（周瑜）Java - SpringBoot 持久化 WebShell 学习demo（不仅仅是Sp ringBoot，适合任何符合JavaEE规范的服务）
-Baseline-check		windows和linux基线检查，配套自动化检查脚本。纯手打。
Tencent_Yun_tools
CVE-2020-0683		CVE-2020-0683 - Windows MSI “Installer service” Elevation of Privilege
cve-2021-22005-ex p
Logout4Shell		Use Log4Shell vulnerability to vaccinate a victim server again st Log4Shell
Duckyspark		Translator from USB-Rubber-Ducky payloads to a Digispark code.
SIET		Smart Install Exploitation Tool
distorm	3.5.2b	Powerful Disassembler Library For x86/AMD64
shakeitoff	AKB-Rel ease	Windows MSI Installer LPE (CVE-2021-43883)
learn-java-bug
4-ZERO-3		403/401 Bypass Methods + Bash Automation + Your Support ;)
kekeo	2.2.0-2 0211214	A little toolbox to play with Microsoft Kerberos in C
noPac		CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter.
Log4jAttackSurfac e
neofetch	7.1.0	🖼️ A command-line system information tool written in bash 3. 2+
FourEye	1.8	AV Evasion Tool For Red Team Ops
SSRFire		An automated SSRF finder. Just give the domain name and your s erver and chill! ;) Also has options to find XSS and open redir ects
gobfuscate		Obfuscate Go binaries and packages
subjs	v1.0.1	Fetches javascript file from a list of URLS or subdomains.
lolcat		Rainbows and unicorns!
StandIn	v1.3	StandIn is a small .NET35/45 AD post-exploitation toolkit
VMware_vCenter		VMware vCenter 7.0.2.00100 unauth Arbitrary File Read + SSRF + Reflected XSS
3gstudent
CVE-2021-42321		Microsoft Exchange Server Poc
k8s-CVE-2021-4355 7-poc		PoC for CVE-2021-43557
CVE-2021-41277		Metabase任意文件读取漏洞批量扫描工具
aem-hacker
Corsy	1.0-rc	CORS Misconfiguration Scanner
YarnRpcRCE	0.0.1
bitcracker		BitCracker is the first open source password cracking tool for memory units encrypted with BitLocker
CVE-2021-37580		CVE-2021-37580
SharpMapExec
fmem		Linux Kernel Module designed to help analyze volatile memory i n the linux kernel
F5-steganography		F5 steganography
tyton	v1.2	Kernel-Mode Rootkit Hunter
JavaCodeAudit		Getting started with java code auditing 代码审计入门的小项目
SharpSphere	2.1	.NET Project for Attacking vCenter
crawlergo_x_XRAY		360/0Kee-Team/crawlergo动态爬虫结合长亭XRAY扫描器的被动扫描功能
pafish	v0.6	Pafish is a testing tool that uses different techniques to det ect virtual machines and malware analysis environments in the s ame way that malware families do
geye	1.2.0	🚀Faster Github Monitor🚀
aSiagaming		My Chrome and Safari exploit code + write-up repo
CVE-2021-36260-me tasploit		the metasploit script(POC) about CVE-2021-36260
HikPwn		HikPwn, a simple scanner for Hikvision devices with basic vuln erability scanning capabilities written in Python 3.8.
Gitlab-CVE-2021-2 2205
BruteShark	v1.2.5	Network Analysis Tool
pkcrack		pkcrack with modern building tools
CVE-2020-9484
avList		avList - 杀软进程对应杀软名称
impacket-ghostpot ato		impacket-ghostpotato Fork from https://shenaniganslabs.io/2019 /11/12/Ghost-Potato.html
nosferatu		Windows NTLM Authentication Backdoor
Finger		A tool for recognizing function symbol
CVE-2020-5902		CVE-2020-5902 BIG-IP
jarm
Exchange_SSRF		Some Attacks of Exchange SSRF ProxyLogon&ProxyShell
PortBrute		一款跨平台小巧的端口爆破工具，支持爆破FTP/SSH/SMB/MSSQL/MYSQL/ POSTGRESQL/MONGOD / A cross-platform compact port blasting tool that supports blasting FTP/SSH/SMB/MSSQL/MYSQL/POSTGRESQL/MONG OD
NetLoader		Loads any C# binary in mem, patching AMSI + ETW.
KMS_VL_ALL	44	🔑KMS_VL_ALL - Smart Activation Script
NetUser	2.0	使用windows api添加用户，可用于net无法使用时.分为nim版，c++版本，RDI版，BOF版。
CVE-2021-22005
henggeFish		自动化批量发送钓鱼邮件（横戈安全团队出品）
CVE-2021-3493		Ubuntu OverlayFS Local Privesc
coremail-address- book	0.0.2	📧Coremail邮件系统组织通讯录导出脚本
JavaScript-MD5		JavaScript MD5 implementation. Compatible with server-side env ironments like node.js, module loaders like RequireJS and all w eb browsers.
wmi	1.1.0	WMI for Go
evilzip	1.1	evilzip lets you create a zip file(with password) that contain s files with directory traversal characters in their embedded p ath.
PrintNightmare
Tools		GitHub repository for sysadmin related tools
CVE-2021-40444		CVE-2021-40444 PoC
altdns		Generates permutations, alterations and mutations of subdomain s and then resolves them
CS_mock		模拟cobalt strike beacon上线包. Simulation cobalt strike beaco n connection packet.
htpwdScan		HTTP weak pass scanner
BeaconEye		Hunts out CobaltStrike beacons and logs operator command outpu t
outguess	0.4	Universal steganographic tool
pupy		Pupy is an opensource, cross-platform (Windows, Linux, OSX, An droid) C2 and post-exploitation framework written in python and C
CVE-2021-1675_RDL _LPE		PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR。
CVE-2021-26084_Po C
sensinfor	1.6	A chrome extension use to find leak file and backup file.
coremail-exp
tongda-exp	1.0.1	python编写的多个通达常见漏洞exp
proxyshell-for-ex change_workload
CORS_vulnerable_L ab-Without_Databas e
cve-2021-3449		CVE-2021-3449 OpenSSL denial-of-service exploit 👨🏻‍💻
31-days-of-API-Se curity-Tips		This challenge is Inon Shkedy's 31 days API Security Tips.
jobber	v1.4.4	An alternative to cron, with sophisticated status-reporting an d error-handling
Invoke-BuildAnony mousSMBServer		Use to build an anonymous SMB file server.
textfilter		敏感词过滤的几种实现+某1w词敏感词库
proxyshell-poc
RGPerson		RGPerson - Randomly generate identity information
PadBuster		Automated script for performing Padding Oracle attacks
redis-rogue-serve r-win		Redis 4.x & 5.x RCE
vulnerability
proxyshell_payloa d		proxyshell payload generate
ProxyShell		ProxyShell POC Exploit : Exchange Server RCE (ACL Bypass + EoP + Arbitrary File Write)
ADCSPwn	ADCSPwn	A tool to escalate privileges in an active directory network b y coercing authenticate from machine accounts and relaying to t he certificate service.
experiments		Expriments
CS-Loader		CS免杀
OSCP_note
CVE-Exploits		PoC exploits for software vulnerabilities
xcdn		Try to find out the real ip behind cdn
PySharpSphere		Yet another SharpSphere
IOCs-IDPS		This repository will hold PCAP IOC data related with known mal ware samples (owner: Bryant Smith)
SecurityBaselineC heck
surferFTP		SSRF to TCP Port Scanning, Banner and Private IP Disclosure by abusing the FTP protocol/clients
HiveNightmare	0.6	Exploit allowing you to read registry hives as non-admin on Wi ndows 10 and 11
CobaltStrikeDetec ted		40行代码检测到大部分CobaltStrike的shellcode
CVE-2021-3156		Sudo Baron Samedit Exploit
CVE-2021-33909		Sequoia exploit (7/20/21)
TongdaOA-exp		TongdaOA 11.7 ~11.8 通达OA，任意用户登录+后台getshell
cve-2021-34558
CVE-2018-3245		CVE-2018-3245-PoC
CVE-2021-21974		POC for CVE-2021-21974 VMWare ESXi RCE Exploit
CVE-2021-1675		C# and Impacket implementation of PrintNightmare CVE-2021-1675 /CVE-2021-34527
CVE-2020-11651		CVE-2020-11651: Proof of Concept
speedtest-cli	v2.1.3	Command line interface for testing internet bandwidth using sp eedtest.net
CVE-2021-1675-LPE		Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021- 34527
xxl-job	1.0	xxl-job RESTful API RCE
Limelighter		A tool for generating fake code signing certificates or signin g real ones
chacal		Golang anti-vm framework for Red Team and Pentesters
yaml-payload-for- Win		用于windows反弹shell的yaml-payload
ssh-auditor	v0.18	The best way to scan for weak ssh passwords on your network
Catch-Browser		This is a crawler password tool
emby_ssrf
windows-kernel-ex ploits		windows-kernel-exploits Windows平台提权漏洞集合
fuzzdb	v0.3	Dictionary of attack patterns and primitives for black-box app lication fault injection and resource discovery.
Teemo		A Domain Name & Email Address Collection Tool
luaforwindows	v5.1.5- 52	Lua for Windows is a 'batteries included environment' for the Lua scripting language on Windows. NOTICE: Looking for maintain er.
corsair_scan	v0.2.0	Corsair_scan is a security tool to test Cross-Origin Resource Sharing (CORS).
cronsun	v0.3.5	A Distributed, Fault-Tolerant Cron-Style Job System.
blog-hugo		基于Hugo的静态博客
CVE-2021-31166	v1	Proof of concept for CVE-2021-31166, a remote HTTP.sys use-aft er-free triggered remotely.
OscpStudyGroup		Oscp study group
nmap-bootstrap-xs l		A Nmap XSL implementation with Bootstrap.
AntSword-Labs		Awesome environment for antsword tests
iconhash	v0.4.3	fofa shodan favicon.ico hash icon ico 计算器
TLS-poison
CTF-Mind-maps		整合入门到中高级题目的思路，for new CTFers !
endlessh	1.0	SSH tarpit that slowly sends an endless banner
smuggler		Smuggler - An HTTP Request Smuggling / Desync testing tool wri tten in Python 3
cuckoo	2.0.6	Cuckoo Sandbox is an automated dynamic malware analysis system
RCE-Exploit-in-BI G-IP
payloads		Git All the Payloads! A collection of web attack payloads.
morty		Privacy aware web content sanitizer proxy as a service
SimpleShellcodeIn jector		SimpleShellcodeInjector receives as an argument a shellcode in hex and executes it. It DOES NOT inject the shellcode in a thi rd party application.
big-list-of-naugh ty-strings		The Big List of Naughty Strings is a list of strings which hav e a high probability of causing issues when used as user-input data.
msbuild-inline-ta sk
List-RDP-Connecti ons-History		Use powershell to list the RDP Connections History of logged-i n users or all users
Eventlogedit-evt- -General		Remove individual lines from Windows Event Viewer Log (EVT) fi les
From-System-autho rity-to-Medium-aut hority		Penetration test
Eventlogedit-evtx --Evolution	v1.1.0	Remove individual lines from Windows XML Event Log (EVTX) file s
CVE-2021-24086		Proof of concept for CVE-2021-24086, a NULL dereference in tcp ip.sys triggered remotely.
RedGhost		Linux post exploitation framework written in bash designed to assist red teams in persistence, reconnaissance, privilege esca lation and leaving no trace.
CoreMailUploadRce		Coremail任意文件上传漏洞POC
Syborg		Recursive DNS Subdomain Enumerator with dead-end avoidance sys tem (BETA)
x-crack	1.0.1	x-crack - Weak password scanner, Support: FTP/SSH/SNMP/MSSQL/M YSQL/PostGreSQL/REDIS/ElasticSearch/MONGODB
suricata-rules		Suricata IDS rules 用来检测红队渗透/恶意行为等，支持检测Cobalt Strike/MSF/Empire/DNS隧道/Weevely/菜刀/冰蝎/挖矿/反弹shell/ICMP 隧道等
REALITY_SMASHER		vRealize RCE + Privesc (CVE-2021-21975, CVE-2021-21983, CVE-0D AY-?????)
CVE-2021-22986		CVE-2021-22986 & F5 BIG-IP RCE
geacon		修改自geacon的多功能linux运维管理工具
SharpProxyLogon		C# POC for CVE-2021-26855 aka ProxyLogon, supports the classic ally semi-interactive web shell as well as shellcode injection
Python-dsstore		A library for parsing .DS_Store files and extracting file name s
Evaluation_tools		测评工具
sasquatch
hey	v0.1.4	HTTP load generator, ApacheBench (ab) replacement
Luyten	v0.5.4_ Rebuilt_ with_Lat est_depe nencies	An Open Source Java Decompiler Gui for Procyon
ProxyLogon
ProxyLogon		ProxyLogon(CVE-2021-26855+CVE-2021-27065) Exchange Server RCE( SSRF->GetWebShell)
security-research -pocs		Proof-of-concept codes created as part of security research do ne by Google Security Team.
Proxylogon-exploi t		proxylogon exploit - CVE-2021-26857
CVE-2017-7494		Remote root exploit for the SAMBA CVE-2017-7494 vulnerability
CVE-2021-21972		CVE-2021-21972 Unauthorized RCE in VMware vCenter metasploit e xploit script
Vulmap		Vulmap Online Local Vulnerability Scanners Project
CVE-2021-1732-Exp loit		CVE-2021-1732 Exploit
Malbox		恶意软件容器靶机
CVE-2021-23132		com_media allowed paths that are not intended for image upload s to RCE
DotNetToJScriptMi ni		A simplified version of DotNetToJScript to create a JScript fi le which loads a .NET v2 assembly from memory.
exploits		Some of my exploits.
CVE-2021-21972		Proof of Concept Exploit for vCenter CVE-2021-21972
CANToolz	v3.7.0	CANToolz - Black-box CAN network analysis framework
Inspur		Inspur vul repo
WebAliveScan		对目标域名进行快速的存活扫描、简单的指纹识别、目录扫描
linuxprivchecker		linuxprivchecker.py -- a Linux Privilege Escalation Check Scri pt
awesome-iocs		A collection of sources of indicators of compromise.
ruler	2.4.1	A tool to abuse Exchange services
SpringBootLearnin g		Spring Boot learning process
Mod_Rewrite_Autom ation		Scripts to automate standing up apache2 with mod_rewrite in fr ont of C2 servers.
CVE-2021-3156-plu s		CVE-2021-3156非交互式执行命令
Jumpserver-EXP		JumpServer远程代码执行漏洞检测利用脚本
CVE-2021-3156		PoC for CVE-2021-3156 (sudo heap overflow)
wrk		Modern HTTP benchmarking tool
docker-oracle-xe- 11g		Dockerfile of Oracle Database Express Edition 11g Release 2
CVE-2019-1040		CVE-2019-1040 with Exchange
CVE-2021-3156
CVE-2021-3156		CVE-2021-3156
laravel-exploits		Exploit for CVE-2021-3129
ListRDPConnection s	0.0.3	C# 读取本机对外RDP连接记录和其他主机对该主机的连接记录，从而在内网渗透中获取更多可通内网网段信息以及定位运维管理人员主机
webuploader	0.1.5	It's a new file uploader solution!
BT_Panel_Privileg e_Escalation		宝塔面板Windows版提权方法
suricata-rules		Suricata rules for the new critical vulnerabilities
AheadLib-x86-x64	1.2	hijack dll Source Code Generator. support x86/x64
EgGateWayGetShell _py		EgGateWayGetShell py脚本
skyscorpion	1.0.rel ease.202 10322	新版将不再对外公开发布。天蝎权限管理工具采用Java平台的JavaFX技术开发的桌面客户端，支持跨平台运行，目前基于JDK1.8开发，运行必须安装JDK或JRE 1.8，注意不能是open jdk，只能是oracle的jdk。天蝎权限管理工具基于冰蝎加密流量进行WebShell通信管理的原理，目前实现了 jsp、aspx、php、asp端的常用操作功能，在原
passToJs		爆破js加密的后台登陆；JS加密；爆破密码；PyExecJS
SAP_EEM_CVE-2020- 6207		PoC for CVE-2020-6207 (Missing Authentication Check in SAP Sol ution Manager)
bugbounty-cheatsh eet		A list of interesting payloads, tips and tricks for bug bounty hunters.
LuWu		红队基础设施自动化部署工具
CVE-2020-36179		CVE-2020-36179~82 Jackson-databind SSRF&RCE
SharpRDPLog	0.1	Windows rdp相关的登录记录导出工具，可用于后渗透中Windows服务器的信息收集阶段。输出内容包括：本地rdp端口、mstsc缓存、cmdkey缓存、登录成功、失败日志事件。
Drupalgeddon2		Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600 / SA-CORE-2018-002)
CVE-2020-17518
windows_protocol
fuxploider	v1.0	File upload vulnerability scanner and exploitation tool.
dcpwn		an impacket-dependent script exploiting CVE-2019-1040
CVE-2020-35728		CVE-2020-35728 & Jackson-databind RCE
CVE-2020-6308-PoC		PoC CVE-2020-6308
open-source-badge s		Open Source & Licence Badges
CVE-2020-17144-EX P		Exchange2010 authorized RCE
LsassSilentProces sExit		Command line interface to dump LSASS memory to disk via Silent ProcessExit
UnblockNeteaseMus ic	v0.25.3	Revive unavailable songs for Netease Cloud Music
xpinyin		Translate Chinese hanzi to pinyin (拼音) by Python, 汉字转拼音
AngelSword		Python3编写的CMS漏洞检测框架
MobaXterm-Decrypt or		MobaXterm Decryptor
web-cve-tests		A simple framework for sending test payloads for known web CVE s.
rsdl		Subdomain Scan With Ping Method.
volatility		An advanced memory forensics framework
CVE-2020-17144		weaponized tool for CVE-2020-17144
dnSpy	v6.1.8	.NET debugger and assembly editor
Kali-TX		Customized Kali Linux - Ansible playbook
kalitools		Kali Linux工具清单
ActuatorExploit		SpringBoot Actuator未授权自动化利用，支持信息泄漏/RCE
web-log-parser		An open source analysis web log tool
Apache-NiFi-Api-R CE
wfuzz	v3.1.0	Web application fuzzer
peerflix		Streaming torrent client for node.js
HackMySQL		Using To MySQL Elevate Privileges.
CVE-2020-14882		CVE-2020–14882、CVE-2020–14883
webshell-detect-b ypass		绕过专业工具检测的Webshell研究文章和免杀的Webshell
hackergame2018-wr iteups		Write-ups for hackergame 2018
Malleable-C2-Prof iles		Malleable C2 is a domain specific language to redefine indicat ors in Beacon's communication. This repository is a collection of Malleable C2 profiles that you may use. These profil
subjack	2.1	Subdomain Takeover tool written in Go
CVE-2020-1472		Exploit Code for CVE-2020-1472 aka Zerologon
bigdata_practice		大数据分析可视化实践
beanstack	v0.6.1	X41 BeanStack - Stack Trace Fingerprinting BETA
CVE-2020-13935		Exploit for WebSocket Vulnerability in Apache Tomcat
XxlJob-Hessian-RC E		XxlJob<=2.1.2配置不当情况下反序列化RCE
java-file-ftp		POC for leaking java version through file and ftp protocols
ja3transport		Impersonating JA3 signatures
Impulse		💣 Impulse Denial-of-service ToolKit
SharpChromium		.NET 4.0 CLR Project to retrieve Chromium data, such as cookie s, history and saved logins.
js-port-knocking		Web 端口敲门的奇思妙想
pure-bash-bible		📖 A collection of pure bash alternatives to external processe s.
rekall	v1.7.1	Rekall Memory Forensic Framework
tlslite-ng		New home of the TLS implementation in pure python
springfox	3.0.0	Automated JSON API documentation for API's built with Spring
HERCULES		HERCULES is a special payload generator that can bypass antivi rus softwares.
Quickdraw-Snort		Digital Bond's IDS/IPS rules for ICS and ICS protocols.
geacon		Practice Go programming and implement CobaltStrike's Beacon in Go
SAP_RECON		PoC for CVE-2020-6287, CVE-2020-6286 (SAP RECON vulnerability)
GitGot		Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.
Print-My-Shell		Python script wrote to automate the process of generating vari ous reverse shells.
firmwalker		Script for searching the extracted firmware file system for go odies!
CVE-2020-1472		PoC for Zerologon - all research credits go to Tom Tervoort of Secura
tget		tget is wget for torrents
pentest-wiki		PENTEST-WIKI is a free online security knowledge library for p entesters / researchers. If you have a good idea, please share it with others.
synner		A TCP SYN flood client written in Rust, powered by libpnet
CVE-2020-15148-by passes		几条关于CVE-2020-15148（yii2反序列化）的绕过
cve-2020-14386
memshell	mxd_reb ehinder_ v3_0_5	Tomcat 冰蝎内存马。
xvwa		XVWA is a badly coded web application written in PHP/MySQL tha t helps security enthusiasts to learn application security.
cupp		Common User Passwords Profiler (CUPP)
AhMyth-Android-RA T		Android Remote Administration Tool
CVE-2020-0787-EXP -ALL-WINDOWS-VERSI ON	1	Support ALL Windows Version
POC-T	2.0.5	渗透测试插件化并发框架 / Open-sourced remote vulnerability PoC /EXP framework
ysoserial-mangguo gan
ICS-Protocol-iden tify		Using nmap NSE scripts for identifying common ICS protocols[使用nmap的nse脚本对常见工控协议进行识别，附对应nse脚本，并记录pcap 流量]
snmpwn		An SNMPv3 User Enumerator and Attack tool
wait-for-it		Pure bash script to test and wait on the availability of a TCP host and port
Bad-Pdf	v1.1	Steal Net-NTLM Hash using Bad-PDF
PowerSploit	v3.0.0	PowerSploit - A PowerShell Post-Exploitation Framework
jmet	0.1.0	Java Message Exploitation Tool
CS-checklist	v1.0	PC客户端（C-S架构）渗透测试checklist / Client side(C-S) penetr ation checklist
Nmap-Tools		SpiderLabs shared Nmap Tools
mole	v0.1	Mole is a framework for identifying and exploiting out-of-band application vulnerabilities.
shiroPoc	0.0.05
MSSQL_BackDoor
OSCP		OSCP
Exploit-Framework		🔥 An Exploit framework for Web Vulnerabilities written in Python
google_dork_list		Google Dorks
CAS_EXP	0.0.1	CAS 硬编码远程代码执行漏洞
Serverless-Top-10 -Project	1.0	OWASP Serverless Top 10
kostebek	v1.2.0
Intensio-Obfuscat or		Obfuscate a python code 2.x and 3.x
CVE-2020-8559		This is a PoC exploit for CVE-2020-8559 Kubernetes Vulnerabili ty
PE2HTML		Injects HTML/PHP/ASP to the PE
CVE-2020-6287-exp loit		PoC for CVE-2020-6287 The PoC in python for add user only, no administrator permission set. Inspired by @zeroSteiner from met asploit. Original Metasploit PR module: https://github.
smogcloud		Find cloud assets that no one wants exposed 🔎 ☁️
memtriage	v0.3.2- alpha	Allows you to quickly query a Windows machine for RAM artifact s
CVE-2020-1350-DoS		A denial-of-service proof-of-concept for CVE-2020-1350
Exploits		Exploits for various CVEs
crowbar	v4.2	Crowbar is brute forcing tool that can be used during penetrat ion tests. It is developed to support protocols that are not cu rrently supported by thc-hydra and other popular brute
f5-bigip-rce-cve- 2020-5902		F5 BIG-IP RCE CVE-2020-5902 automatic check tool
CVE-2020-11651-po c		PoC exploit of CVE-2020-11651 and CVE-2020-11652
cobalt_strike_bot
SMBGhost_RCE_PoC
PocCollect		Poc Collected for study and develop
ripple20-poc		Treck Network Stack Discovery Tool by JSOF
LeakLooker		Find open databases - Powered by Binaryedge.io
Reptile	2.0	LKM Linux rootkit
tomcat_nofile_web shell		Tomcat基于动态注册Filter的无文件Webshell
cve-2020-1054		LPE for CVE-2020-1054 targeting Windows 7 x64
CVE-2020-1066-EXP	exp	CVE-2020-1066-EXP支持Windows 7和Windows Server 2008 R2操作系统
Spring-Boot-Actua tor-Exploit		Spring Boot Actuator (jolokia) XXE/RCE
XssPy		XssPy - Web Application XSS Scanner
LSB-Steganography		Python program to steganography files into images using the Le ast Significant Bit.
CallStranger		Vulnerability checker for Callstranger (CVE-2020-12695)
BadDNS	v1.0.1
ICSim		Instrument Cluster Simulator
Vulnerability-goa pp		Web application build Golang with Vulnerability
VpsEnvInstall		一键部署渗透VPS
factordb-python	1.3.0	FactorDB client library with Python
RedisWriteFile		通过 Redis 主从写出无损文件
CVE-2020-3153		Cisco AnyConnect < 4.8.02042 privilege escalation through path traversal
Pentest_Interview		个人准备渗透测试和安全面试的经验之谈，和去部分厂商的面试题，干货真的满满~
redis-ssrf		redis ssrf gopher generater & redis ssrf to rce by master-slav e-sync
SB-Actuator		Spring Boot Actuator未授权访问【XXE、RCE】单/多目标检测
flashsploit		Exploitation Framework for ATtiny85 Based HID Attacks
tomcat-cluster-se ssion-sync-exp		tomcat使用了自带session同步功能时，不安全的配置（没有使用Encry ptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包，可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不是CVE-2020-9484，9484是session持久化的洞，这个是session集群同步的洞！
CVE-2020-10199		CVE-2020-10199 回显版本
RDODecrypt		Remote Desktop Organizer 密码破解
CAAC-CTF-2018-Pri mary		2018年民航网络安全职业技能竞赛-初赛
writeups		昔書いたctfライトアップなど
mssqli-duet		SQL injection script for MSSQL that extracts domain users from an Active Directory environment based on RID bruteforcing
cve-2020-11651-ex p-plus
isf	v0.1.0	ISF(Industrial Control System Exploitation Framework)，a explo itation framework based on Python
static-binaries		Various *nix tools built as statically-linked binaries
asset		NMAP扫描网络资产自动导入到Elasticstack进行展示
MassBleed		MassBleed SSL Vulnerability Scanner
awesome-shodan-qu eries		🔍 A collection of interesting, funny, and depressing search q ueries to plug into shodan.io 👩‍💻
vmware_vcenter_cv e_2020_3952		Exploit for CVE-2020-3952 in vCenter 6.7
android-malware		Collection of android malware samples
assetfinder		Find domains and subdomains related to a given domain
redis-rce		Redis RCE 的几种方法
Xray_and_crwlergo _in_server		雇一位免费的360工程师和一位长亭工程师为你挖洞，还有听话的serve r酱给你汇报
CVE-2020-0796	v1.0	CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost
nyancat	1.2.1	Nyancat in your terminal, rendered through ANSI escape sequenc es. This is the source for the Debian package nyancat.
linux-kernel-expl oits		linux-kernel-exploits Linux平台提权漏洞集合
o365enum		Enumerate valid usernames from Office 365 using ActiveSync, Au todiscover v1, or office.com login page.
CrackSleeve		破解CS4.0
cve-2019-1040-sca nner
CVE-2020-0688		Exploit and detect tools for CVE-2020-0688
CVE-2019-1040-dcp wn		CVE-2019-1040 with Kerberos delegation
OA-tongda-RCE		Office Anywhere网络智能办公系统
IoT_Sec_Tutorial		IoT安全教程
CVE-2019-1388		guest→system（UAC手动提权）
motd		My funny motd config. Just for fun!
emergency-respons e-checklist	1.0	应急响应指南 / emergency response checklist
hack_postgres		便捷地使用PostgreSQL自定义函数来执行系统命令，适用于数据库管理员知道postgres密码却不知道ssh或RDP密码的时候在服务器执行系统命令。
CVE-2020-9548		CVE-2020-9548：FasterXML/jackson-databind 远程代码执行漏洞
CVE-2020-9547		CVE-2020-9547：FasterXML/jackson-databind 远程代码执行漏洞
leaky-repo	1.1.2	Benchmarking repo for secrets scanning
cve-2020-0688		cve-2020-0688
javasec_study		java代码审计学习笔记
Spray-AD		A Cobalt Strike tool to audit Active Directory user accounts f or weak, well known or easy guessable passwords.
CVE-2020-8813		The official exploit for Cacti v1.2.8 Remote Code Execution CV E-2020-8813
CNVD-2020-10487-T omcat-Ajp-lfi		Tomcat-Ajp协议文件读取漏洞
CVE-2020-0668		Use CVE-2020-0668 to perform an arbitrary privileged file move operation.
updog	1.4	Updog is a replacement for Python's SimpleHTTPServer. It allow s uploading and downloading via HTTP/S, can set ad hoc SSL cert ificates and use http basic auth.
SiteCopy		sitecopy is a tool that facilitates personal website backup an d network data collection
jieba	v0.42.1	结巴中文分词
Bashfuscator		A fully configurable and extendable Bash obfuscation framework . This tool is intended to help both red team and blue team.
SharpToolsAggress or		内网渗透中常用的c#程序整合成cs脚本，直接内存加载。持续更新~
WDExtract		Extract Windows Defender database from vdm files and unpack it
bucket-stream		Find interesting Amazon S3 Buckets by watching certificate tra nsparency logs.
CVE-2019-8449		CVE-2019-8449 Exploit for Jira v2.1 - v8.3.4
ffuf-scripts		Scripts to help with different ffuf tasks and workflows
lmg		Script for automating Linux memory capture and analysis
CVE-2018-0296		Script to test for Cisco ASA path traversal vulnerability (CVE -2018-0296) and extract system information.
spring-boot-actua tor-h2-rce		Sample Spring Boot App Demonstrating RCE via Exposed env Actua tor and H2 Database
PrivExchange		Exchange your privileges for Domain Admin privs by abusing Exc hange
cve-2019-19781		This is a tool published for the Citrix ADC (NetScaler) vulner ability. We are only disclosing this due to others publishing t he exploit code first.
at-ps		Adversary Tactics - PowerShell Training
CVE-2019-0708-EXP -Windows	1.0	CVE-2019-0708-EXP-Windows版单文件exe版,运行后直接在当前控制台反弹System权限Shell
SharpNetCheck
docker_mirror	v1.0	查找最快的docker镜像
Xiaomi_Mi_WiFi_R3 G_Vulnerability_PO C		A login bypass(CVE-2019-18371) and a command injection vulnera bility(CVE-2019-18370) in Xiaomi Router R3G up to version 2.28. 23.
CVE-2019-19781		Citrix ADC Remote Code Execution
LLC		Linux Log Cleaner (utmp, wtmp, btmp, lastlog)
CVE-2019-1215
hsd-cipher-sm		国产密码算法SM2，SM3，SM4
ICS-pcap		A collection of ICS/SCADA PCAPs
Vxscan		python3写的综合扫描工具，主要用来存活验证，敏感文件探测(目录扫描/js泄露接口/html注释泄露)，WAF/CDN识别，端口扫描，指纹/服务识别，操作系统识别，POC扫描，SQL注入，绕过CDN，查询旁站等功能，主要用来甲方自测或乙方授权测试，请勿用来搞破坏。
CVE-2019-9810	1	Exploit for CVE-2019-9810 Firefox on Windows 64-bit.
jd-gui	v1.6.6	A standalone Java Decompiler GUI
AssetScan		资产探测工具，检测存活，检测风险端口，常规端口，全端口探测等等，对探测的端口的脆弱面进行安全分析进行
ClashA	0.0.3.9	A Android GUI for Clash
wordpress-dos-poc		WordPress <= 5.3.? DoS
how-does-MobaXter m-encrypt-password		This repo offers a tool to reveal password encrypted by MobaXt erm.
how-does-Xmanager -encrypt-password		This is a repo to tell you how Xmanager (XFtp, XShell) encrypt password. Transferred from https://github.com/DoubleLabyrinth/ how-does-Xmanager-encrypt-password
Probable-Wordlist s	v2.0	Version 2 is live! Wordlists sorted by probability originally created for password generation and testing - make sure your pa sswords aren't popular!
linux-hardening-c hecklist		Simple checklist to help you deploying the most important area s of the GNU/Linux production systems - work in progress.
gogsownz		Gogs CVEs
idcardgenerator	win_v1. 3	身份证图片生成工具 generate an id card picture
ThreatHound		ThreatHound is a threat intelligence query tool use for detect ing potentially malicious IP or domains. It combines the MISP o pen source threat intelligence sharing platform as its
EBurst		这个脚本主要提供对Exchange邮件服务器的账户爆破功能，集成了现有主流接口的爆破方式。
Cisco-UCM-SQLi-sc ripts		Scripts that can be used to exploit CVE-2019-15972 which was a n Authenticated SQLi issue in Cisco Unified Call Manager (UCM).
genpAss
massh-enum		OpenSSH 2.3 up to 7.4 Mass Username Enumeration (CVE-2018-1547 3).
SHIRO-721		RememberMe Padding Oracle Vulnerability RCE
RdpThief		Extracting Clear Text Passwords from mstsc.exe using API Hooki ng.
Diggy		Extract endpoints from apk files.
phuip-fpizdam		Exploit for CVE-2019-11043
CVE-2017-1000353	1.1	jenkins CVE-2017-1000353 POC
webmin_cve-2019-1 2840_poc		A standalone POC for CVE-2019-12840
aws_public_ips	1.0.7	Fetch all public IP addresses tied to your AWS account. Works with IPv4/IPv6, Classic/VPC networking, and across all AWS serv ices
RoarCTF-Writeup-s ome-Source-Code		没有怎么整理，大家将就看吧，有问题发一个issue给我
CVE-2017-3506		CVE-2017-3506
CVE-2017-17562		Standalone Python 3 exploit for CVE-2017-17562
CVE-2019-3396		Confluence 未授权 RCE (CVE-2019-3396) 漏洞
apache-		apache权限维持后门
patoolkit	v1.0	PA Toolkit is a collection of traffic analysis plugins focused on security
snmp_fuzzer		snmp_fuzzer
CloudUnflare		Reconnaissance Real IP address for Cloudflare Bypass
CVE-2019-7609		exploit CVE-2019-7609(kibana RCE) on right way by python2 scri pts
Firewall		美国国家安全局NSA下属方程式黑客组织（Equation Group）被The Sha dow Brokers（影子经纪人）hack出来的并免费分享的源码
RoarCTF-Writeup-2 019		https://github.com/berTrAM888/RoarCTF-Writeup-some-Source-Code .git
cve-2017-18635		PoC for CVE-2017-18635
Venom	v1.1.0	Venom - A Multi-hop Proxy for Penetration Testers
sec-chart		安全思维导图集合
struts2-057-exp		s2-057 最新漏洞分析和EXP脚本
batch_ping		support multi ping
PortTran		PortTran (.NET端口转发工具,支持任意权限)
cve-2019-0708		Metasploit module for massive Denial of Service using #Bluekee p vector.
ispy		ispy V1.0 - Eternalblue(ms17-010)/Bluekeep(CVE-2019-0708) Scan ner and exploit ( Metasploit automation )
loginlog_windows		读取登录过本机的登录失败或登录成功的所有计算机信息，在内网渗透中快速定位运维管理人员。
CVE-2019-8451		Jira未授权SSRF漏洞
Vegile		This tool will setting up your backdoor/rootkits when backdoor already setup it will be hidden your spesisifc process,unlimit ed your session in metasploit and transparent. Even whe
rtcp	v0.1.0	利用 Python 的 Socket 端口转发，用于远程维护
CVE-2019-10392		CVE-2019-10392 RCE Jackson with Git Client Plugin 2.8.2 (Authe nticated)
APTnotes		Various public documents, whitepapers and articles about APT c ampaigns
as_webshell_venom		免杀webshell无限生成工具蚁剑版
CVE-2019-1579
ACLight		A script for advanced discovery of Privileged Accounts - inclu des Shadow Admins
CVE-2019-1132		EoP POC for CVE-2019-1132
secscan-authcheck	v0.1	越权检测工具
BlueKeep		Proof of concept for CVE-2019-0708
RSA-In-CTF
CVE-2019-11510		Exploit for Arbitrary File Read on Pulse Secure SSL VPN (CVE-2 019-11510)
fastjson_gadgets_ scanner
CVE-2019-15642		Webmin Remote Code Execution (authenticated)
staffdb
AggressorScript-C reateCloneHiddenAc count		创建一个克隆隐藏的管理员账号/Create a Clone Hidden Administrat or Account
GoogleHacking-Pag e		This is a summary of my study and use of Google hacking. I hop e I can share it with you. If you like, please give me a star o r fork it, thank you.
30min_guides		覃健祥的学习笔记，各种几十分钟入门的文档
RedTeam-BCS		BCS（北京网络安全大会）2019 红队行动会议重点内容
CVE-2017-12149		Jboss Java Deserialization RCE (CVE-2017-12149)
Subdomain-Takeove r		一个子域名接管检测工具
CVE-2019-7238		Nexus Repository Manager 3 Remote Code Execution without authe ntication < 3.15.0
RSA-ATTACK		RSA加密应用常见缺陷的原理与实践
CVE-2018-13379		CVE-2018-13379
CVE-2018-13382		CVE-2018-13382
Kayak	untagge d-359703 9ad20ce9 798a99	Kayak is a CAN bus analysis tool based on SocketCAN
CVE-2019-2725		CVE-2019-2725 命令回显
halive		A fast http and https prober, to check which URLs are alive
sec_tools
Jackson_RCE-CVE-2 019-12384		CVE-2019-12384 漏洞测试环境
Nmap_Bypass_IDS		Nmap&Zmap特征识别，绕过IDS探测
CVE-2019-13272		Linux 4.10 < 5.1.17 PTRACE_TRACEME local root
BB-Tips		Collection of Bug Bounty Tips
InfinityHook		Hook system calls, context switches, page faults and more.
golang-developer- roadmap-cn		在 2019 成为一名 Go 开发者的路线图。为学习 Go 的人而准备。
CVE-2019-12384		Jackson Rce For CVE-2019-12384
BKScan		BlueKeep scanner supporting NLA
CVE-2019-11580		CVE-2019-11580 Atlassian Crowd and Crowd Data Center RCE
discuz-ml-rce		discuz ml rce
Red-Baron		Automate creating resilient, disposable, secure and agile infr astructure for Red Teams.
LuCI_RCE_exp		Exp of cve-2019-12272
RedisModules-Exec uteCommand		Tools, utilities and scripts to help you write redis modules!
redis-rogue-serve r		Redis 4.x & 5.x RCE
zoom_vulnerabilit y_poc
instantbox		📦 Get a clean, ready-to-go Linux box in seconds.
CTF		保存有关自己做的 CTF 题目
Cipher_Encryption _Type_Identificati on		对密文的加密类型进行判断的命令行工具。
dics
security		Some of my security stuff and vulnerabilities. Nothing advance d. More to come.
jenkins-rce		😈 Jenkins RCE PoC. From unauthenticated user to re mote code execution, it's a hacker's dream!
rdpscan		A quick scanner for the CVE-2019-0708 "BlueKeep" vulnerability .
docker-vulnerabil ity-environment		Use the docker to build a vulnerability environment
Nessus_to_report		Nessus中文报告自动化脚本
Serverless-Goat		OWASP ServerlessGoat: a serverless application demonstrating c ommon serverless security flaws
aquatone	v1.7.0	A Tool for Domain Flyovers
awesome-jenkins-r ce-2019		There is no pre-auth RCE in Jenkins since May 2017, but this i s the one!
CVE-2019-0803		Win32k Elevation of Privilege Poc
CVE-2019-2615
XAntiDebug		VMProtect 3.x Anti-debug Method Improved
WSPIH		Website Sensitive Personal Information Hunter 网站个人敏感信息文件扫描器
S9MF-php-webshell -bypass		为方便WAF入库的项目
CapOS		等级保护测评windows工具源码
yujianrdpcrack		御剑RDP爆破工具
lor-axe		🪓 a multi-threaded, low-bandwidth HTTP DOS tool
Hosts_scan		这是一个用于IP和域名碰撞匹配访问的小工具，旨意用来匹配出渗透过程中需要绑定hosts才能访问的弱主机或内部系统。
cve-2018-1273		Spring Data Commons RCE 远程命令执行漏洞
CNVD-C-2019-48814 -COMMON		CNVD-C-2019-48814 poc work on linux and windows
Threat-Intelligen ce-Analyst		威胁情报，恶意样本分析，开源Malware代码收集
BlueCommand		Dashboarding and Tooling front-end for PowerShell Empire using PowerShell Universal Dashboard
CVE-2019-3396_EXP		CVE-2019-3396 confluence SSTI RCE
vlany		Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)
w8fuckcdn		Get website IP address by scanning the entire net 通过扫描全网绕过CDN获取网站IP地址
RW_Password		此项目用来提取收集以往泄露的密码中符合条件的强弱密码
UPGDSED	v1.1.2	Universal PatchGuard and Driver Signature Enforcement Disable
SQLInjectionWiki		一个专注于聚合和记录各种SQL注入方法的wiki
sas-top-10		Serverless Architectures Security Top 10 Guide
phpinfo_scanner		一个抓取phpinfo重要信息的小工具
Win-Logs-Parse-to ol
BlockRDPBrute		[HIPS]RDP(3389)爆破防护
acefile		POC of https://research.checkpoint.com/extracting-code-executi on-from-winrar/
awesome-serverles s-security		A curated list of awesome serverless security resources such a s (e)books, articles, whitepapers, blogs and research papers.
CVE-2019-7238		🐱‍💻 Poc of CVE-2019-7238 - Nexus Repository Manager 3 Remot e Code Execution 🐱‍💻
CVE-2018-20250		exp for https://research.checkpoint.com/extracting-code-execut ion-from-winrar
cve-2019-1003000- jenkins-rce-poc		Jenkins RCE Proof-of-Concept: SECURITY-1266 / CVE-2019-1003000 (Script Security), CVE-2019-1003001 (Pipeline: Groovy), CVE-20 19-1003002 (Pipeline: Declarative)
JavaID		java source code static code analysis and danger function iden tify prog
ja3_4java		Java library for SSL/TLS ja3 fingerprint
SharpShooter		Payload Generation Framework
Kali-learning-not es		Write down some kali learning notes
CiscoRV320Dump		CVE-2019-1652 /CVE-2019-1653 Exploits For Dumping Cisco RV320 Configurations & Debugging Data AND Remote Root Exploit!
SharpDump		SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 funct ionality.
bugcrowd-levelup- subdomain-enumerat ion		This repository contains all the material from the talk "Esote ric sub-domain enumeration techniques" given at Bugcrowd LevelU p 2017 virtual conference
Digispark-Duckdui no		Poor man's rubber ducky
impacket-examples -windows	v0.9.17	The great impacket example scripts compiled for Windows
mijisou		Privacy-respecting metasearch engine
bypass_disablefun c_via_LD_PRELOAD		bypass disable_functions via LD_PRELOA (no need /usr/sbin/send mail)
webshell		入侵分析时发现的Webshell后门
icsmaster		ICS/SCADA Security Resource（整合工控安全相关资源）
Paper		Web Security Technology & Vulnerability Analysis Whitepapers
CVE-2018-8581		CVE-2018-8581
rdpwrap	v1.6.2	RDP Wrapper Library
CTF-Training		收集各大比赛的题目和Writeup
SharpPack		An Insider Threat Toolkit
cve-2018-1002105		Test utility for cve-2018-1002105
poc_CVE-2018-1002 105		PoC for CVE-2018-1002105.
Invoke-TheHash		PowerShell Pass The Hash Utils
CVE-2018-0296	v0.0.4	Test CVE-2018-0296 and extract usernames
CVE-2018-3252		CVE-2018-3252-PoC
SessionGopher		SessionGopher is a PowerShell tool that uses WMI to extract sa ved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Des
riscv-ida		RISC-V ISA processor module for IDAPro 7.x
NATBypass		一款lcx在golang下的实现, 可用于内网穿透, 建立TCP反弹隧道用以绕过防火墙入站限制等, A tool for establish reverse tunnel for NAT network environment and proxy, support all functions of lcx.exe
JQShell		A weaponized version of CVE-2018-9206
CVE-2017-7269-Ech o-PoC		CVE-2017-7269 回显PoC ,用于远程漏洞检测..
CVE-2018-2893		CVE-2018-2893-PoC
XXEpayload
CVE-2018-9206		A Python PoC for CVE-2018-9206
SpoolerScanner		Check if MS-RPRN is remotely available with powershell/c#
modbus-cli		Modbus command line utility
base100		base💯 - Encode your data into emoji
wavecrack	v1.0	Wavestone's web interface for password cracking with hashcat
luacheck	0.23.0	A tool for linting and static analysis of Lua code.
Internal-Monologu e		Internal Monologue Attack: Retrieving NTLM Hashes without Touc hing LSASS
me_cleaner	v1.2	Tool for partial deblobbing of Intel ME/TXE firmware images
SpoolSample		PoC tool to coerce Windows hosts authenticate to other machine s via the MS-RPRN RPC interface. This is possible via other pro tocols as well.
dictionary		List of some dictionaries
Win2016LPE		Windows10 & Windows Server 2016 LPE Exploit (use schedsvc!SchR pcSetSecurity())
SM2Java		国密SM2,SM3 Java实现
write-ups-2015		Wiki-like CTF write-ups repository, maintained by the communit y. 2015
CVE-2018-8420		原PoC甚至符号都打错了！太不走心了！
CVE-2018-15473-Ex ploit		Exploit written in Python for CVE-2018-15473 with threading an d export formats
butterfly		A web terminal based on websocket and tornado
ASWCrypter		An Bash&Python Script For Generating Payloads that Bypasses Al l Antivirus so far [FUD]
EventCleaner		A tool mainly to erase specified records from Windows event lo gs, with additional functionalities.
PHP_Code_Challeng e		总结一些php代码审计ctf练习题
Pass-to-hash-EWS
MITMf	v0.9.8	Framework for Man-In-The-Middle attacks
ueditor-getshell		ueditor .net getshell
mscache		a tool to manipulate dcc(domain cached credentials) in windows registry, based mainly on the work of mimikatz and impacket
ExchangeRelayX		An NTLM relay tool to the EWS endpoint for on-premise exchange servers. Provides an OWA for hackers.
DotNetToJScript	v1.0.4	A tool to create a JScript file which loads a .NET v2 assembly from memory.
CVE-2018-8120		CVE-2018-8120 Exploit for Win2003 Win2008 WinXP Win7
CTF-RSA		总结一下各路大师傅的RSA脚本233
OSCE		Collection of things made during my preparation to take on OSC E
CVE-2018-2628		CVE-2018-2628 & CVE-2018-2893
OSCE		Some exploits, which I’ve created during my OSCE preparation.
redis_lua_exploit
checkO365		checkO365 is a tool to check if a target domain is using O365
CiscoSmartInstall Exploit
Prowl
poc-cve-2018-1273		POC for CVE-2018-1273
Convert-Invoke-Ke rberoast		Converts the output from Invoke-Kerberoast into hashcat format .
CVE-2018-8174_EXP		CVE-2018-8174_python
naive-hashcat		Crack password hashes without the fuss 🐈
CVE-2018-8174-msf		CVE-2018-8174 - VBScript memory corruption exploit.
java-deserializat ion-exploits		A collection of curated Java Deserialization Exploits
CVE-2018-1111		CVE-2018-1111 DynoRoot
CVE-2018-1111		Environment for DynoRoot (CVE-2018-1111)
GPON		Exploit for Remote Code Execution on GPON home routers (CVE-20 18-10562) written in Python. Initially disclosed by VPNMentor ( https://www.vpnmentor.com/blog/critical-vulnerability-g
CVE-2018-9995_dvr _credentials		(CVE-2018-9995) Get DVR Credentials
Mind-Map		各种安全相关思维导图整理收集
cloud-torrent	0.8.25	☁️ Cloud Torrent: a self-hosted remote torrent client
CVE-2018-7600		Exploit for Drupal 7 <= 7.57 CVE-2018-7600
ProcessInjection		Some ways to inject a DLL into a alive process
scan-backup-langz i-		扫描备份文件和敏感信息泄漏的扫描器，速度快，器大活好
CVE-2018-2380		PoC of Remote Command Execution via Log injection on SAP NetWe aver AS JAVA CRM
BypassCaiDao		过WAF菜刀
clairctl	v1.2.8	Tracking container vulnerabilities with Clair Control for Core OS Clair
TextMining		Python文本挖掘系统 Research of Text Mining System
vncpwd	v0.1	VNC Password Decrypter
nextnet	v0.0.2	nextnet is a pivot point discovery tool written in Go.
CANoodler		CANoolder: CAN to 3.3V logic level interface. Dumb. Cheap. Sim ple. Pick 3.
inSp3ctor		AWS S3 Bucket/Object Finder
suricata-traffici d		Application and service identification rules for Suricata
NtlmRelayToEWS		ntlm relay attack to Exchange Web Services
spectre-attack		Example of using revealed "Spectre" exploit (CVE-2017-5753 and CVE-2017-5715)
cisco-snmp-rce		Cisco IOS SNMP RCE PoC
KPTI-PoC-Collecti on		Meltdown/Spectre PoC src collection.
danderspritz-evtx	v1.0	Parse evtx files and detect use of the DanderSpritz eventloged it module
rce-over-spark		Remote Command Execution Over Spark
Invoke-WCMDump		PowerShell Script to Dump Windows Credentials from the Credent ial Manager
S2-055-PoC		S2-055的环境，基于rest-show-case改造
DigiKeyboard_DE		angepasste Header-Dateien für Deutsches Tastatur Layout
HugeDirtyCowPOC		A POC for the Huge Dirty Cow vulnerability (CVE-2017-1000405)
CVE-2017-11882		Proof-of-Concept exploits for CVE-2017-11882
CVE-2017-11882		CVE-2017-11882 from https://github.com/embedi/CVE-2017-11882
evolve	v1.6	Web interface for the Volatility Memory Forensics Framework
CVE-2017-0199	v4.0.1	Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could ge
CACTUSTORCH		CACTUSTORCH: Payload Generation for Adversary Simulations
PTP-RAT		Exfiltrate data over screen interfaces
awvs_script_decod e		解密好的AWVS10.5 data/script/目录下的脚本
CVE-2017-8759		CVE-2017-8759
SAP-Pentest
volatility-plugin s		Plugins I've written for Volatility
Python-Brainfuck		Just a small Brainfuck interpreter written in Python
Sensitive-word		收集的一些敏感词汇，挺全的，还细分了暴恐词库、反动词库、民生词库、色情词库、贪腐词库、其他词库等
MSSQL-Fileless-Ro otkit-WarSQLKit		Bildiğiniz üzere uzun zamandır MSSQL üzerine çalışmalar yapmak tayım. Bu yazımda uzun zamandır uğraştığım bir konuyu ele alaca ğım, MSSQL Rootkit. Bildiğiniz üzere şimdiye kadar MS-S
DigistumpArduino	1.6.7	Files to add Digistump support (Digispark, Pro, DigiX) to Ardu ino 1.6.X (1.6.5+)
dnsAutoRebinding		ssrf、ssrfIntranetFuzz、dnsRebinding、recordEncode、dnsPoisoni ng、Support ipv4/ipv6
outguess		An unmaintained fork of the OutGuess steganographic tool. Try https://github.com/resurrecting-open-source-projects/outguess f or possibly a better option.
joffrey		Stupid MQTT Brute Forcer
csrf-poc-generato r		this html file creates a csrf poc form to any http request.
Struts2-048		CVE-2017-9791
wydomain		to discover subdomains of your target domain
RiskySPN		Detect and abuse risky SPNs
wifi_keylogger		DIY Arduino Wi-Fi Keylogger (Proof of Concept)
Exploits		Windows Exploits
sandcastle		🏰 A Python script for AWS S3 bucket enumeration.
PocCollect		a plenty of poc based on python
ffmpeg-avi-m3u-xb in
WindowsExploits		Windows exploits, mostly precompiled. Not being updated. Check https://github.com/SecWiki/windows-kernel-exploits instead.
Go-For-OSCP
cve-2017-7269-too l		CVE-2017-7269 to webshell or shellcode loader
vulnd_xxe		A server vulnerable to XXE that can be used to test payloads u sing the xxer tool.
aeskeyfind		Fork of aeskeyfind that knows more formats of AES key schedule
filterbypass		Browser's XSS Filter Bypass Cheat Sheet
kernel-exploits
icmptunnel	v1.0.0	Transparently tunnel your IP traffic through ICMP echo and rep ly packets.
hotoloti		documentation, scripts, tools related to Zena Forensics (http: //blog.digital-forensics.it)
IllegalWordsDetec tion		提供高效率的较简单的Unity3d手游客户端的敏感词检测的算法，能应付大部分敏感词过滤需求
cve-2017-7269		fixed msf module for cve-2017-7269
ZeroNights-HackQu est-2016		2 web tasks from ZeroNights HackQuest 2016
CVE-2016-5195		A CVE-2016-5195 exploit example.
SensitiveWordFilt er		机器学习实现敏感词过滤
duck2spark		Converter for raw RubberDucky payloads to Digispark Arduino ID E Sketch source.
dirtycow-vdso		PoC for Dirty COW (CVE-2016-5195)
MSSQL-SQLi-Labs
Windows-Exploit-S uggester		This tool compares a targets patch levels against the Microsof t vulnerability database in order to detect potential missing p atches on the target. It also notifies the user if ther
docker-remote-api -exp		docker remote api未授权访问的利用代码
ShellcodeWrapper		Shellcode wrapper with encryption for multiple target language s
VolUtility	v1.2	Web App for Volatility framework
winscppasswd	1.0	WinSCP Password Extractor/Decrypter/Revealer written in go lan guage
public		my public code
luadec		Lua Decompiler for lua 5.1 , 5.2 and 5.3
ew		内网穿透(跨平台)
xss		php写的个人研究测试用的 xss cookie 攻击管理平台,开源出来
weakfilescan		动态多线程敏感信息泄露检测工具
peepdf		Powerful Python tool to analyze PDF documents
FingerPrint		web应用指纹识别
SCADAPASS	1.2	SCADA StrangeLove Default/Hardcoded Passwords List
ssh-audit		SSH server auditing (banner, key exchange, encryption, mac, co mpression, compatibility, security, etc)
dirtycow-docker-v dso
MySQL-Monitor		MySQL服务器执行SQL记录实时监控（WEB版本）
linux-inject		Tool for injecting a shared object into a Linux process
sensitive-stop-wo rds		互联网常用敏感词、停止词词库
Conveigh		Conveigh is a Windows PowerShell LLMNR/NBNS spoofer detection tool
armitage		Automatically exported from code.google.com/p/armitage
DirBrute		多线程WEB目录爆破工具 [Multi-thread WEB directory blasting too l(with dics inside) ]
browser-dumpwd		Dump browser passwords(chrome, firefox) with sqlite3 lib.
PoCs		Proof of Concepts for CVE-2016–3714
docker_api_vul		docker 未授权访问漏洞利用脚本
cub3		Proof of concept for LD_PRELOAD malware that uses extended att ributes to protect files.
ios-malware		iOS malware samples
foolav	v1.0	Pentest tool for antivirus evasion and running arbitrary paylo ad on target Wintel host
vulnapp		use docker to attack web as a demo
ysoserial		A proof-of-concept tool for generating payloads that exploit u nsafe Java object deserialization.
Redpoint		Digital Bond's ICS Enumeration Tools
windows-exploits		Used for the osce exam preparation
CVE-2015-7547		Proof of concept for CVE-2015-7547
ntdsxtract		Active Directory forensic framework
getsystem-offline		Small tool to get a SYSTEM shell
Jenkins		Jenkins漏洞探测、用户抓取爆破
clusterd	0.5	application server attack toolkit
FBI-WARNING-in-co nsole		FBI-WARNING-in-console
PLCinject
PixelJihad		A JavaScript steganography tool
PowerShell-AD-Rec on		PowerShell Scripts I find useful
dnsenum	1.2.4.2	dnsenum is a perl script that enumerates DNS information
Unix-Privilege-Es calation-Exploits- Pack		Exploits for getting local root on Linux, BSD, AIX, HP-UX, Sol aris, RHEL, SUSE etc.
rtsp_authgrinder		A authentication brute forcing tool for the rtsp protocol
winshock-test		Bash script that tests if a system is Winshock (MS14-066) vuln erable
UPnP-Pentest-Tool kit		UPnP Pentest Toolkit for Windows
shellshock_scanne r		Python Scanner for "ShellShock" (CVE-2014-6271)
kjackal		Linux Rootkit Scanner
Linux_Exploit_Sug gester		Linux Exploit Suggester; based on operating system release num ber
shellcode_launche r		Shellcode launcher utility
thc-pptp-bruter		[Mirror] thc.org uses a CA that is not trusted on a base Arch system so we are mirroring some source here.
vipasswordict		Vietnamese Password Dicts
tsh		Tiny SHell is an open-source UNIX backdoor.
Rogue-MySql-Serve r		Rogue MySql Server
ReflectiveDLLInje ction		Reflective DLL injection is a library injection technique in w hich the concept of reflective programming is employed to perfo rm the loading of a library from memory into a host pro
pwnginx		Pwn nginx - a nginx backdoor provides shell access, socks5 tun neling, http password sniffing.
BurpAuthzPlugin
lib_mysqludf_sys		A UDF library with functions to interact with the operating sy stem. These functions allow you to interact with the execution environment in which MySQL runs.
base92		Implementations of base92 in various languages (C, python)
h3c-pt-tools		Huawei/H3C/HP Penetration Testing Tools
evilarc		Create tar/zip archives that can exploit directory traversal v ulnerabilities
crawlergo
CVE-2020-1938
Emergency
Cas_Exploit
Shiro-721
CTF-RSA-tool
security
sangfor-edr-explo it
CTFCrackTools
PrintNightmare
VolDiff
graphql-voyager
OSCE-Exploit-Deve lopment
searx
cobaltstrike-bof- toolset
fuzz
company-crawler
metarget
WordPress_4
Hyuga
debugtron
fastjson-1
privilege-escalat ion-awesome-script s-suite
idea-project-fish -exploit
code-server
CVE-2021-26855
pcap_dnsproxy
follina
cas4
odoh-server-go
nps
snort-rules
impacket
PatchAMSI
VirusTotalC2
names
IPList
nginxconfig
RouterScan-consol e
dirtycow
HealthChecker
clash
testssl
RCE-0-day-for-Gho stScript-9
spring-boot-start er-swagger
wechat_info_colle ct
Janus
phpvuln
findomain
IIS_exploit
shadowsocks
ecapture
JSPHorse
DVWA
aSYNcrone
capa
Fofa-collect
clash_for_windows _pkg
bluescan
CVE-2018-14729
EyeWitness
RsaCtfTool
awvs-decode
Windows-Exploit-S uggester
YourNextBugTip
pdf-export
hackingthe
USB-Rubber-Ducky
CobaltSpam
hackbar2
dc_find
masnmapscan-V1
nanodump
BaiLu-SED-Tool
Thanos
password_brute_di ctionary
CVE-2017-12615
S2-045
S2-055
S2-056-XStream
xss-payload-list
httpie
WOTD
CVE-2020-8840
Grafana-VulnTips
ncDecode
webuploader-0
dnscrypt-proxy
jsonhero-web
bro-pdns
Axis-1
2020-Interview-ex perience
CVE-2021-1727
InstallerFileTake Over
ProfSvcLPE
LangNetworkTopolo gy3
DFA
libssh-scanner
mscan
dedecmscan
ddos-tools
slowloris
iCULeak
cryptovenom
2017-Security-ppt
subzy
SharpCookieMonste r
Middleware-Vulner ability-detection
WXDBDecrypt
BurpSuiteSuite-co llections
hackbar2
linux-exploit-sug gester
idcard
EggShell
SeeyonEXP
PowerDNS-Admin
Cas_Exploit
1earn
AboutSecurity
CVE-2021-41653
CVE-2020-0601
SMBGhost
qqwry
chineseocr_lite
Amass
CVE-2022-21907-ht tp
RDWArecon
Ruoyi-All
PeiQi-WIKI-POC
awesome-pentest-n ote
conote-community
CVE-2021-21985
CVE-2021-22005
CVE-2021-29200
CVE-2021-30128
Benchmarks
Hacking-With-Gola ng
joomscan
cs-ssl-gen
hideNsneak
oh-my-zsh
exp
hashtopolis
MITM-cheatsheet
impacket
DumpTheGit
jumpserver_rce
Fuzz_dic
wechat-export
2022-HW-POC
csirt
poshkatz
CVE-2019-2890
VPS-web-hacking-t ools
suricata-rules
metinfo_sqlinject ion
TPScan
microsoftSpider
Struts2_045-Poc
awvs13_batch_py3
blackeye
VTSCAN
prowler
Bug-Hunting-Domai ns
CSAgent
repo-security-sca nner
CVE-2018-8120
CVE-2022-2639-Pip eVersion
CVE-2018-3191
wappalyzer
Kage
sam-the-admin
Whonix
woodpecker-framwo rk-release
fastjson_rce_tool
shiro_rce
gojwtcrack
STS2G
chrome_password_g rabber
wxappUnpacker
xxx
clashX
yougar0
seeyou_exp
CVE-2019-0708
SiteServer-CMS-Re mote-download-Gets hell
zhuqingcode
Joker
gitleaks
RSA

杂七杂八

压测工具

项目名称	版本	项目描述
locust	2.20.0	Write scalable load tests in plain Python 🚗💨

web靶场

项目名称	版本	项目描述
SSRF_Vulnerable_L ab		This Lab contain the sample codes which are vulnerable to Serv er-Side Request Forgery attack
		https://dvwa.co.uk/
DoraBox		DoraBox - Basic Web Vulnerability Training
WackoPicko		WackoPicko is a vulnerable web application used to test web ap plication vulnerability scanners.
xssed		A set of XSS vulnerable PHP scripts for testing
sqli-labs		SQLI labs to test error based, Blind boolean based, Time based .
BWVS		Web漏洞渗透测试靶场
upload-labs	0.1	一个想帮你总结所有类型的上传漏洞的靶场
vulstudy		使用docker快速搭建各大漏洞靶场，目前可以一键搭建17个靶场。
xxe-lab		一个包含php,java,python,C#等各种语言版本的XXE漏洞Demo
vulnerable-node		A very vulnerable web site written in NodeJS with the purpose of have a project with identified vulnerabilities to test the q uality of security analyzers tools tools
vulfocus	v0.3.2. 11	🚀Vulfocus 是一个漏洞集成平台，将漏洞环境 docker 镜像，放入即可使用，开箱即用。
hackademic		the main hackademic code repository
Hello-Java-Sec	1.10	☕️ Java Security，安全编码和代码审计
SpringBootVulExpl oit		SpringBoot 相关漏洞学习资料，利用方法和技巧合集，黑盒安全评估 check list
ElectricRat	v1.3.0	电气鼠靶场系统是一种带有漏洞的Web应用程序，旨在为Web安全渗透测试学习者提供学习和实践的机会。The Electrical Mouse Target Range System is a web application with vulnerabilities designed to pr ovide learning and practice opport
VulApps		快速搭建各种漏洞环境(Various vulnerability environment)
bodgeit	1.4.0	The BodgeIt Store is a vulnerable web application which is cur rently aimed at people who are new to pen testing.
MCIR		The Magical Code Injection Rainbow! MCIR is a framework for bu ilding configurable vulnerability testbeds. MCIR is also a coll ection of configurable vulnerability testbeds.
DSVW		Damn Small Vulnerable Web
SecExample		JAVA 漏洞靶场 (Vulnerability Environment For Java)
vulhub		Pre-Built Vulnerable Environments Based on Docker-Compose
webug4.0		webug4.0
WebGoat	v2023.8	WebGoat is a deliberately insecure application
pikachu		一个好玩的Web安全-漏洞测试平台
		https://hackmyvm.eu/anon/
		https://www.pentesterlab.com/exercises/web_for_pentester/course

APP合规

项目名称	版本	项目描述
camille		基于Frida的Android App隐私合规检测辅助工具

chatgpt

项目名称	版本	项目描述
Awesome-ChatGPT		ChatGPT资料汇总学习，持续更新......
chatgpt		ChatGPT网址导航，分享免费好用AI网站！
ChatGPT-Shortcut		🚀💪Maximize your efficiency and productivity, support for Eng lish,中文,Español,العربية. 让生产力加倍的AI快捷指令。更有效地定制、保存和分享自己的提示词。在提示词分享社区中，轻松找到适用于不同场景的指令。
chatgpt-mac	v0.0.5	ChatGPT for Mac, living in your menubar.
awesome-chatgpt-z h		ChatGPT 中文指南🔥，ChatGPT 中文调教指南，指令指南，应用开发指南，精选资源清单，更好的使用 chatGPT 让你的生产力 up up up! 🚀

github加速

项目名称	版本	项目描述
FastGithub	2.1.4	github加速神器，解决github打不开、用户头像无法加载、releases无法上传下载、git-clone、git-pull、git-push失败等问题

MySQL实时监控工具

项目名称	版本	项目描述
MySQLMonitor	1.0	MySQL实时监控工具(代码审计/黑盒/白盒审计辅助工具)

pppoe拦截

项目名称	版本	项目描述
pppoe-intercept	v0.3	用来模拟中间人拦截 pppoe 拨号过程的账号密码

python笔记

项目名称	版本	项目描述
Python-100-Days		Python - 100天从新手到大师

安全思维脑图

项目名称	版本	项目描述
HackerMind		各种安全相关思维导图整理收集。渗透步骤，web安全，CTF，业务安全，人工智能，区块链安全，数据安全，安全开发，无线安全，社会工程学，二进制安全，移动安全，红蓝对抗，运维安全，风控安全，linux安全

按键精灵

项目名称	版本	项目描述
KeymouseGo	v5.1.1	类似按键精灵的鼠标键盘录制和自动化操作模拟点击和键入

报告模板

项目名称	版本	项目描述
HackReport		渗透测试报告/资料文档/渗透经验文档/安全书籍

动态口令

项目名称	版本	项目描述
rotp	v6.3.0	Ruby One Time Password library

短信轰炸

项目名称	版本	项目描述
SMSBoom	main	短信轰炸/短信测压/

短信转发器

项目名称	版本	项目描述
SmsForwarder	v3.2.0	短信转发器——监控Android手机短信、来电、APP通知，并根据指定规则转发到其他手机：钉钉群自定义机器人、钉钉企业内机器人、企业微信群机器人、飞书机器人、企业微信应用消息、邮箱、bark、webhook、Tel egram机器人、Server酱、PushPlus、手机短信等。包括主动控制服务端与客户端，让你轻松远程发短信、查短信、查通话、查话簿、查电量等。

恶意网络流量模拟

项目名称	版本	项目描述
flightsim	v2.5.0	A utility to safely generate malicious network traffic pattern s and evaluate controls.

机器学习

项目名称	版本	项目描述
Augmentor		Image augmentation library in Python for machine learning.
dddd_trainer		ddddocr训练工具

科学上网

项目名称	版本	项目描述
v2rayfree		v2ray节点、免费节点、免费v2ray节点、最新公益免费v2ray节点订阅地址、免费v2ray节点每日更新、免费ss/v2ray/trojan节点、freefq
free		翻墙、免费翻墙、免费科学上网、免费节点、免费梯子、免费ss/v2ray /trojan节点、蓝灯、谷歌商店、翻墙梯子
v2rayA	v2.2.4. 3	A web GUI client of Project V which supports VMess, VLESS, SS, SSR, Trojan, Tuic and Juicity protocols. 🚀

克隆声音

项目名称	版本	项目描述
MockingBird	v0.0.1	🚀AI拟声: 5秒内克隆您的声音并生成任意语音内容 Clone a voice in 5 seconds to generate arbitrary speech in real-time

区块链

项目名称	版本	项目描述
zksync-auto		some help for zksync incentive
zksync
all-in-one-v2
zksync2-python	v0.6.0

渗透测试报告辅助

项目名称	版本	项目描述
BugRepoter_0x727		BugRepoter_0x727(自动化编写报告平台)根据安全团队定制化协同管理项目安全，可快速查找历史漏洞，批量导出报告。
SAReport		渗透测试自动化报告平台
APTRS		Automated Penetration Testing Reporting System
report	v1.0.1	乙方渗透测试漏洞报告管理系统
pentest_report	v1.0.0	A pentest reporter generator
WaterExp		WaterExp:面向安服仔的水报告模板和工具
Savior	new	渗透测试报告自动生成工具！

生成虚假数据

项目名称	版本	项目描述
faker	v21.0.0	Faker is a Python package that generates fake data for you.

数据库管理软件

项目名称	版本	项目描述
dbeaver	23.3.0	Free universal database tool and SQL client

网站压测工具

项目名称	版本	项目描述
dperf	v1.6.0	dperf is a 100Gbps network load tester.
WebBench		Webbench是Radim Kolar在1997年写的一个在linux下使用的非常简单的网站压测工具。它使用fork()模拟多个客户端同时访问我们设定的URL，测试网站在压力下工作的性能，最多可以模拟3万个并发连接去测试网站的负载能力。官网地址:http://home.tiscali.cz/~cz210552/webbench.h tml

文字识别

项目名称	版本	项目描述
Umi-OCR	release /2.0.1	OCR software, free and offline. 开源、免费的离线OCR软件。支持截屏/粘贴/批量导入图片，段落排版/排除水印，扫描/生成二维码。内置多国语言库。

验证码生成

项目名称	版本	项目描述
Calculate_Captcha	v1.1	计算验证码生成器，用于训练使用

远程软件

项目名称	版本	项目描述
FreeRDP	2.11.4	FreeRDP is a free remote desktop protocol library and clients
Quasar	v1.4.1	Remote Administration Tool for Windows
rustdesk	1.2.3	An open-source remote desktop, and alternative to TeamViewer.

项目名称	版本	项目描述
rotateproxy	v0.7.2	利用fofa搜索socks5开放代理进行代理池轮切的工具
ProxyPoolxSocks	v1.2	☁️Socks代理池服务端自动化搭建工具☁️
Gofreeproxy	v0.1	自用的动态代理小工具
proxy_pool	2.4.1	Python ProxyPool for web spider
mubeng	v0.14.1	An incredibly fast proxy checker & IP rotator with ease.
go_proxy_pool	2022.11 .22	无环境依赖开箱即用的代理IP池
proxyServer	v1.0	本项目其实就是个简单的代理服务器，把代理池集成进来来了。
Venom-Transponder		毒液流量转发器：自动化捡洞/打点/跳板必备神器，支持联动URL爬虫、各种被动扫描器。
Auto_proxy		利用IP地址池进行自动切换Http代理，防止IP封禁。

项目名称	版本	项目描述
ApoalypseSecTools		ApoalypseSecTool更新地址
Pentest-Windows	v2.2	Windows11 Penetration Suite Toolkit 一个开箱即用的windows渗透测试环境
PST-Bucket		Scoop-Buket for Penetration Suite Toolkit
PenKitGui		渗透测试武器库
GUI_Tools	V1.1	一个由各种图形化渗透工具组成的工具集
commando-vm		Complete Mandiant Offensive VM (Commando VM), a fully customiz able Windows-based pentesting virtual machine distribution. com [email protected]
okfafu-pentestVM- public		okfafu渗透虚拟机公开版
Taie-RedTeam-OS		泰阿安全实验室-基于XUbuntu私人订制的红蓝对抗渗透操作系统
FreeGui	v2.5	freeGui：基于ttkbootstrap开发的一款用来管理自己的渗透测试工具的一个小工具，并提供一些实用小功能，例如打开目录，运行工具，工具备忘命令。
Online_tools	0.5.0	该工具是一个集成了非常多渗透测试工具，类似软件商城的工具可以进行工具下载，工具的更新，工具编写了自动化的安装脚本，不用担心工具跑不起来。

项目名称	版本	项目描述
BurpCRLFScan	1.4	使用java编写的CRLF-Injection-burp被动扫描插件
JsonDetect	v1.0	A burp Extender to detect json, include fastjson,jackson,gson
Sylas	1.1.1	新一代子域名主/被动收集工具 - Subdomain automatic/passive coll ection tool
Log4j-check		log4J burp被扫插件、CVE-2021-44228、支持dnclog.cn和burp内置DNS 、可配合JNDIExploit生成payload
shiro-check	shiroch ek3.0	Shiro反序列化回显利用、内存shell、检查 Burp插件
GadgetProbe	v1.0	Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpa ths.
burp-api-drops		burp插件开发指南
domain_hunter	v1.5	A Burp Suite Extension that try to find all sub-domain, simila r-domain and related-domain of an organization automatically! 基于流量自动收集整个企业或组织的子域名、相似域名、相关域名的burp 插件
domain_hunter_pro	v1.9	domain_hunter的高级版本，SRC挖洞、HW打点之必备！自动化资产收集；快速Title获取；外部工具联动；等等
knife	v2.2	A burp extension that add some useful function to Context Menu 添加一些右键菜单让burp用起来更顺畅
reCAPTCHA/blob
captcha-killer	0.1.2	burp验证码识别接口调用插件
chunked-coding-co nverter	0.4.0	Burp suite 分块传输辅助插件
passive-scan-clie nt	0.3.1	Burp被动扫描流量转发插件
sqlmap4burp-plus- plus	0.2	sqlmap4burp++是一款兼容Windows，mac，linux多个系统平台的Burp与 sqlmap联动插件
JC-AntiToken		burp插件：python版，token防重放绕过
HackBar	2.0	HackBar plugin for Burpsuite
BpScan	1.0.0	一款用于辅助渗透测试工程师日常渗透测试的Burp被动漏扫插件
burp-cph	3.0	Custom Parameter Handler extension for Burp Suite.
autoDecoder	0.34	Burp插件，根据自定义来达到对数据包的处理（适用于加解密、爆破等），类似mitmproxy，不同点在于经过了burp中转，在自动加解密的基础上，不影响APP、网站加解密正常逻辑等。
captcha-killer-mo dified	0.24.2	captcha-killer的修改版，支持关键词识别base64编码的图片，添加免费ocr库，用于验证码爆破，适配新版Burpsuite
log4j2burpscanner	0.25.0	CVE-2021-44228 Log4j2 BurpSuite Scanner,Customize ceye.io api or other apis,including internal networks
RouteVulScan	RouteVu lScan1.5	Burpsuite - Route Vulnerable Scanning 递归式被动检测脆弱路径的 burp插件
BurpSuiteCn
semgrepper	v1.3	An extension to use Semgrep inside Burp Suite.
BurpBountyPlus	3	BurpBounty 魔改版本
HaE	2.4.6	HaE - Highlighter and Extractor, 赋能白帽高效作战
base64encode	1.0	burpsuite POST数据包base64编码插件
BurpJSLinkFinder		Burp Extension for a passive scanning JS files for endpoint li nks.
Burp_AES_Plugin		Burpsuite Plugin For AES Crack
OutLook
FastjsonScan	1.0	一个简单的Fastjson反序列化检测burp插件
SpringScan	V1.7	SpringScan 漏洞检测 Burp插件
BurpSuite-collect ions		有关burpsuite的插件(非商店),文章以及使用技巧的收集(此项目不再提供burpsuite破解文件,如需要请在博客mrxn.net下载)---Collection o f burpsuite plugins (non-stores), articles and tips for using B urpsuite, no crack version file
AutoRepeater		Automated HTTP Request Repeating With Burp Suite
BurpSuiteHTTPSmug gler	v0.1	A Burp Suite extension to help pentesters to bypass WAFs or te st their effectiveness using a number of techniques
BurpSuiteLoggerPl usPlus
PowerScanner	1.1.3	面向HW的红队半自动扫描器
BurpExtractor	v1.3.4	A Burp extension for generic extraction and reuse of data with in HTTP requests and responses.
JustC2file	v1.0.2	Burp插件，Malleable C2 Profiles生成器；可以通过Burp代理选中请求，生成Cobalt Strike的profile文件(CSprofile)
BurpFastJsonScan	BurpFas tJsonSca n-2.2.2	一款基于BurpSuite的被动式FastJson检测插件
BurpShiroPassiveS can	BurpShi roPassiv eScan-2. 0.0	一款基于BurpSuite的被动式shiro检测插件
http-request-smug gler
burp-requests	v0.2.4	Copy as requests plugin for Burp Suite
burp-text4shell	v0.1	Text4Shell scanner for Burp Suite
fastjson-exp
NEW_xp_CAPTCHA	4.2	xp_CAPTCHA(瞎跑白嫖版) burp 验证码识别 burp插件
xia_Liao	1.6	xia Liao（瞎料）burp插件用于Windows在线进程/杀软识别与 web渗透注册时，快速生成需要的资料用来填写，资料包含：姓名、手机号、身份证、统一社会信用代码、组织机构代码、银行卡，以及各类web语言的h ello world输出和生成弱口令字典等。
BurpSuite_403Bypa sser		Burpsuite Extension to bypass 403 restricted directory
Burp-Non-HTTP-Ext ension
HopLa	1.2	HopLa Burp Suite Extender plugin - Adds autocompletion suppor t and useful payloads in Burp Suite
burpFakeIP	1.1	服务端配置错误情况下用于伪造ip地址进行测试的Burp Suite插件
burpJsEncrypter	0.1	More Easier Burp Extension To Solve Javascript Front End Encry ption,一款更易使用的解决前端加密问题的Burp插件。
SpringVulScan	SpringV ulScan-1 .1	burpsuite 的Spring漏洞扫描插件。SpringVulScan：支持检测：路由泄露
TsojanScan	v1.4.4	一个集成的BurpSuite漏洞探测插件
BurpSuite-Extende r-fastjson		Reference：https://www.w2n1ck.com/article/44/
OneScan	v1.4.0	OneScan是递归目录扫描的BurpSuite插件
HackTools	1.5	提高渗透测试效率。#Burp插件##渗透测试##小工具#
BurpSuite-Xkeys		A Burp Suite Extension to extract interesting strings (key, se cret, token, or etc.) from a webpage.
npscrack	npscrac k-1.0	蓝队利器、溯源反制、NPS 漏洞利用、NPS exp、NPS poc、Burp插件、一键利用
HostHeaderAttack	0.1.1	检测host头攻击的Burpsuite被动扫描插件，Burpsuite passive scann ing plugin responsible for detecting host header attack
BurpCrypto		BurpCrypto is a collection of burpsuite encryption plug-ins, s upport AES/RSA/DES/ExecJs(execute JS encryption code in burpsui te). 支持多种加密算法或直接执行JS代码的用于爆破前端加密的BurpSu ite插件
Log4j2Scan	dev-202 30804T02 5448	Log4j2 RCE Passive Scanner plugin for BurpSuite
passive-scan-clie nt-plus	v0.4.12 .0	burpsuite passive-scan-client 插件维护分支
sweetPotato	version 1.6	基于burpsuite的资产分析工具
fastjsonScan		fastjson漏洞burp插件，检测fastjson<1.2.68基于dnslog，fastjson< =1.2.24和1.2.33<=fatjson<=1.2.47的不出网检测和TomcatEcho,Spring Echo回显方案。
CORSScanner		CORS 跨域漏洞 burp 插件
Fastjson-Scanner		a burp extension to find where use fastjson
taborator		A Burp extension to show the Collaborator client in a tab
collaborator-ever ywhere		A Burp Suite Pro extension which augments your proxy traffic b y injecting non-invasive headers designed to reveal backend sys tems by causing pingbacks to Burp Collaborator
awesome-burp-exte nsions		A curated list of amazingly awesome Burp Extensions
BurpCollaboratorD NSTunnel		A DNS tunnel utilizing the Burp Collaborator
LoggerPlusPlus	v3.20.0	Advanced Burp Suite Logging Extension
awesome-burp-suit e		Awesome Burp Suite Resources. 400+ open source Burp plugins, 4 00+ posts and videos.
blackboxprotobuf		Blackbox protobuf is a Burp Suite extension for decoding and m odifying arbitrary protobuf messages without the protobuf type definition.
BurpBounty	BurpBou nty_v4.0	Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to im prove the active and passive scanner by means of person
burp-bounty		Burp Bounty profiles
burp-wildcard	1.08	Burp extension intended to compact Burp extension tabs by hija cking them to own tab.
AES-Killer	v4.0	Burp Plugin to decrypt AES encrypted traffic on the fly
BurpSuite-Asset_D iscover		Burp Suite extension to discover assets from HTTP response.
burp-UnicodeAutoD ecode		Burpsuite插件，Unicode自动转码为中文，提高测试效率。
CaA	0.5	CaA - BurpSuite Collector and Analyzer
checkburp		Detect burp
generator-burp-ex tension		Everything you need about Burp Extension Generation
upload-scanner		HTTP file upload scanner for Burp Proxy
inql	v5.0.2	InQL is a robust, open-source Burp Suite extension for advance d GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
J2EEScan	v2.0.0	J2EEScan is a plugin for Burp Suite Proxy. The goal of this pl ugin is to improve the test coverage during web application pen etration tests on J2EE applications.
Jsdir		Jsdir is a Burp Suite extension that extracts hidden paths fro m js files and beautifies it for further reading.
JSONP-Hunter		JSONP Hunter in burpsuite.
Burp2Malleable		Quick python utility I wrote to turn HTTP requests from burp s uite into Cobalt Strike Malleable C2 profiles
SQL-Injection-Pay loads		SQL Injection Payloads for Burp Suite, OWASP Zed Attack Proxy, ...
ssrf-king	v1.12	SSRF plugin for burp Automates SSRF Detection in all of the Re quest
Brida	v0.6pre	The new bridge between Burp Suite and Frida!
turbo-intruder	1.0.19	Turbo Intruder is a Burp Suite extension for sending large num bers of HTTP requests and analyzing the results.
Wsdler	2.0.12	WSDL Parser extension for Burp
xia_sql	3.3	xia SQL (瞎注) burp 插件，在每个参数后面填加一个单引号，两个单引号，一个简单的判断注入小插件。
wooyun-payload	1.0	从wooyun中提取的payload，以及burp插件
BurpCollect		基于BurpCollector的二次开发，记录Burpsuite Site Map记录的里的数据包中的目录路径参数名信息，并存入Sqlite，并可导出txt文件。
Caidao-AES-Versio n		一个Burp插件，实现用AES算法透明加密原版菜刀Caidao.exe与服务器端交互的http数据流
jsEncrypter	0.3.2	一个用于前端加密Fuzz的Burp Suite插件
HTTPHeadModifer	v0.1	一款快速修改HTTP数据包头的Burp Suite插件

项目名称	版本	项目描述
SharkExec		内网渗透
geacon_pro
LSTAR	v2.1	LSTAR - CobaltStrike 综合后渗透插件
taowu-cobalt-stri ke
Registry-Recon		Cobalt Strike Aggressor Script that Performs System/AV/EDR Rec on
RedWarden		Cobalt Strike C2 Reverse proxy that fends off Blue Teams, AVs, EDRs, scanners through packet inspection and malleable profile correlation
malleable-c2		Cobalt Strike Malleable C2 Design and Reference Guide
csbruter		Cobalt Strike team server password brute force tool
EventLogMaster		Cobalt Strike插件 - RDP日志取证&清除
Cobalt_Strike_wik i		Cobalt Strike系列
CVE-2022-39197		CobaltStrike <= 4.7.1 RCE
Erebus	V1.3.6	CobaltStrike后渗透测试插件

项目名称	版本	项目描述
fofa_GUI	v1.0.0
fofa_viewer	1.1.13	A simple FOFA client written in JavaFX. Made by WgpSec, Mainta ined by f1ashine.
fofax	v0.1.44	fofax is a command line query tool based on the API of https:/ /fofa.info/, simple is the best!

项目名称	版本	项目描述
mipsAudit		IDA MIPS静态扫描脚本，汇编审计辅助脚本
IDA-Pro-tips		IDA Pro每周小技巧
AlphaGolang		IDApython Scripts for Analyzing Golang Binaries
ida_python_extrac tCode		ida提取特征码脚本

项目名称	版本	项目描述
NessusReportInChi nese		半自动化将 Nessus 英文报告（csv格式）生成中文 excel ，中文漏洞库已有700多条常见漏洞，后续再进一步加上新漏洞自动翻译，实现全自动化
NessusToReport	v1.2	Nessus扫描报告自动化生成工具
CN_Nessus_Plugins _Interface	1	nessus插件中文查询接口
nessus_api		Nessus REST API 封装
docker_nessus_unl imited		docker build nessus with unlimited ip

项目名称	版本	项目描述
NucleiTP
nucleix		整合nuclei与xray(社区版、自带高级版)，实现被动扫描+poc扫描自动化渗透流程
nuclei-plus	v7.0.0	Functional enhancement based on nuclei

项目名称	版本	项目描述
ExpToPocsuite3	v1.0	goby exp批量转换为pocsuite3 exp脚本
some_pocsuite		用于漏洞排查的pocsuite3验证POC代码

项目名称	版本	项目描述
RSAS-Data-Export	2022-9- 9	绿盟极光远程安全评估系统(RSAS)-RSAS漏洞数据导出工具
RSAS-Task-Release	v1.0	绿盟极光远程安全评估系统(RSAS)-RSAS批量下任务工具
nsfocus-rsas-know ledge-base		绿盟科技漏洞扫描器(RSAS)漏洞库

项目名称	版本	项目描述
super-xray	1.7	Web漏洞扫描工具XRAY的GUI启动器
Xray_Cracked	v1.9.11	Update Xray1.9.11 Cracked for Windows,Linux and Mac OS.
xray-poc-generati on		🧬 辅助生成 XRay YAML POC
yarx	v0.2.0	An awesome reverse engine for xray poc.

项目名称	版本	项目描述
ZoomEye-go	v1.5	The Golang SDK and CLI of ZoomEye@Knownsec by gyyyy.
Kunyu	v1.7.2	Kunyu, more efficient corporate asset collection
ZoomEye-python	v2.2.0	ZoomEye-python: The official Python library and CLI by Knownse c 404 Team.

项目名称	版本	项目描述
anti-honeypot		一款可以检测WEB蜜罐并阻断请求的Chrome插件
superSearchPlus		谷歌插件版本- superSearchPlus是聚合型信息收集插件，支持综合查询，资产测绘查询，信息收集敏感信息提取 js资源扫描目录扫描 vue 组件扫描整合了目前常见的资产测绘平台同时支持数据导出
SwitchyOmega	v2.5.20	Manage and switch between multiple proxies quickly & easily.
untrusted-types	1.1.1
fofa_view	v0.0.5	FOFA Pro view 是一款FOFA Pro 资产展示浏览器插件，目前兼容 Chro me、Firefox、Opera。
Heimdallr
Zoomeye-Tools		Zoomeye Tools是配合Zoomeye使用的Chrome插件
Hack-Tools	0.5.0	The all-in-one Red Team extension for Web Pentester 🛠
mitaka	v1.4.1	A browser extension for OSINT search

项目名称	版本	项目描述
penetration-suite -toolkit	v4.0	本项目制作的初衷是帮助渗透新手快速搭建工作环境，工欲善其事，必先利其器。
TranSec	transec os1.0	Internet of Vehicles Penetration testing OS. An out of the box testing environment that includes hundreds of commonly used to olsets for penetration testing of the Internet of Vehic

项目名称	版本	项目描述
RedTeamTools		分享红队常用的工具
All-Defense-Tool		本项目集成了全网优秀的攻防武器工具项目，包含自动化利用，子域名、目录扫描、端口扫描等信息收集工具，各大中间件、cms漏洞利用工具，爆破工具、内网横向及免杀、社工钓鱼以及应急响应等资料。
404StarLink		404StarLink - 推荐优质、有意义、有趣、坚持维护的安全开源项目
About-Attack		一个旨在通过应用场景 / 标签对 Github 红队向工具 / 资源进行分类收集，降低红队技术门槛的手册【持续更新】
Scanners-Box		A powerful and open-source toolkit for hackers and security au tomation - 安全行业从业者自研开源扫描器合辑

项目名称	版本	项目描述
Threathunting-boo k
PenetrationTestti ps		渗透测试Tips - Version1.3
1earn		暂停维护
Pentools-wiki		先是渗透工具合集，其次是wiki，做点不一样的x
Intranet_Penetrat ion_Tips		2018年初整理的一些内网渗透TIPS，后面更新的慢，所以整理出来希望跟小伙伴们一起更新维护~
Awesome-Redteam		一个攻防知识仓库
Vuln-List		(持续更新)对网上出现的各种OA、中间件、CMS等漏洞进行整理，主要包括漏洞介绍、漏洞影响版本以及漏洞POC/EXP等，并且会持续更新。
SecurityInterview Guide		网络信息安全从业者面试指南

项目名称	版本	项目描述
PasswordDic		2011-2019年Top100弱口令密码字典 Top1000密码字典服务器SSH/VPS 密码字典后台管理密码字典数据库密码字典子域名字典
Dictionary-Of-Pen testing		Dictionary collection project such as Pentesing, Fuzzing, Brut eforce and BugBounty. 渗透测试、SRC漏洞挖掘、爆破、Fuzzing等字典收集项目。
Dirpath_List		Dirpath_List 目录扫描字典
AboutSecurity	v2	Everything for pentest.
JavaFileDict		Java应用的一些配置文件字典，来源于公开的字典与平时收集
fuzzDicts		Web Pentesting Fuzz 字典,一个就够了。
wpa-dictionary		WPA/WPA2 密码字典，用于 wifi 密码暴力破解
Blasting_dictiona ry		爆破字典
bottleneckOsmosis		瓶颈渗透,web渗透,red红队,fuzz param,注释,js字典,ctf
SaiDict		弱口令,敏感目录,敏感文件等渗透测试常用攻击字典
BurpCollector		通过BurpSuite来构建自己的爆破字典，可以通过字典爆破来发现隐藏资产。
name-fuzz		针对目标已知信息的字典生成工具
gendict	v1.0.5	字典生成工具

lscherry / sectool Goto Github PK

sectool's Introduction

更新于 2023-12-15 08:36:20

近15天release更新记录

近15天commit提交记录

安全

CTF

AWD

靶场

防护

脚本

开源平台

Crypto

古典密码

autokey

现代密码

RSA

Misc

16进制编辑

编码解码

二维码批量识别

自动拼图

综合

Pwn

Reverse

Java反编译

pyc逆向

查壳

Web

定向目录扫描

相关资源

红队

Web安全

漏洞发现库

安卓漏洞扫描

安卓抓包辅助

半自动漏洞扫描

代码审计

java

other

python

口令爆破

漏洞发现

漏洞扫描框架

微信小程序辅助

信息泄露监控

中间件&框架漏洞扫描

漏洞利用库

OA产品漏洞

OA综合

泛微OA

通达OA

用友OA

致远OA

蓝凌OA

半自动化漏洞利用

编辑器漏洞

UEditor

产品

组件

常规web漏洞

CLRF

CORS

DOS

JWT

SQL注入

SSRF

SSTI

XSS

XXE

解析漏洞

文件包含

漏洞检测利用仓库

漏洞利用辅助

漏洞利用框架

漏洞文库

信息泄露漏洞

.DS_Store泄露

.git泄露

.svn泄露