thatqier Goto Github PK

flash-hijack

flash 劫持轮子，CSRF，劫持，跳转，swf 有需求可以提issues ，src挖掘,劫持response

fuzzdb

一个fuzzdb扩展库

fuzzdicts

Web Pentesting Fuzz 字典,一个就够了。

get_ip_by_ico

从shodan获取使用了相同favicon.ico的网站

go-common

哔哩哔哩 bilibili 网站后台工程 源码

gutils

http-open-proxy-anon

It is a new NSE script for NMap. The target is try to find full anonymous proxies.

iis_exploit

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.

intranet_penetration_tips

2018年初整理的一些内网渗透TIPS，后面更新的慢，所以公开出来希望跟小伙伴们一起更新维护~

java-object-searcher

java内存对象搜索工具

javaweb-sec

攻击Java Web应用-[Java Web安全]

jd_seckill

京东秒杀商品抢购

jsfinder

JSFinder is a tool for quickly extracting URLs and subdomains from JS files on a website.

langsrccurise

SRC子域名资产监控

linkfinder

A python script that finds endpoints in JavaScript files

markdown-xss-payloads

XSS payloads for exploiting Markdown syntax

marshalsec

medusa

美杜莎扫描器:cat2:https://www.ascotbe.com/Medusa

micro8

Gitbook

miniprogram-demo

微信小程序示例

mod0burpuploadscanner

HTTP file upload scanner for Burp Proxy

mypayloads

对国外的PayloadsAllTheThings进行中文翻译，同时整理的一些自己的Payloads，包括且不限于sql，xss，用于fuzz、bypass

mytools

:hammer_and_wrench:一些小工具脚本

nexus_rce_cve-2019-7238

Some debug notes and exploit(not blind)

nmap-nse-scripts

My collection of nmap NSE scripts

nmap_socket_http_proxy

nmap代理扫描检测脚本，调用myip.ipip.net

oneforall

OneForAll是一款功能强大的子域收集工具

payloadsallthethings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

pentest_interview

个人准备渗透测试和安全面试的经验之谈，和去部分厂商的面试题，干货真的满满~

php-sdk

Qiniu Resource (Cloud) Storage SDK for PHP