Aura : Python Source Code Auditing And Static Analysis On A Large Scale
Aura is a static analysis framework developed as a response to the ever-increasing threat of malicious packages and vulnerable code published on PyPI. Project goals: provide an automated monitoring system over uploaded packages to PyPI, alert on anomalies that can either indicate an ongoing attack or vulnerabilities in the codeenable an organization to conduct automated security audits of the source code...
BeatRev : POC For Frustrating/Defeating Malware Analysts
.png "BeatRev : POC For Frustrating/Defeating Malware Analysts")
BeatRev is a POC For Frustrating/Defeating Malware Analysts. The first time the malware runs on a victim it AES encrypts the actual payload(an RDLL) using environmental data from that victim. Each subsequent time the malware is ran it gathers that same environmental info, AES decrypts the payload stored as a byte array within the malware, and runs it. If...
ApacheTomcatScanner : A Python Script To Scan For Apache Tomcat Server Vulnerabilities
.png "ApacheTomcatScanner : A Python Script To Scan For Apache Tomcat Server Vulnerabilities")
ApacheTomcatScanner is a python script to scan for Apache Tomcat server vulnerabilities. Features Multithreaded workers to search for Apache tomcat servers. Multiple target source possible: Retrieving list of computers from a Windows domain through an LDAP query to use them as a list of targets. Reading targets line by line from a file. Reading individual targets (IP/DNS/CIDR) from -tt/--target option. Custom list of ports to test. Tests for /manager/html access and...
Aced : Tool to parse and resolve a single targeted Active Directory principal’s DACL
Aced is a tool to parse and resolve a single targeted Active Directory principal's DACL. Aced will identify interesting inbound access allowed privileges against the targeted account, resolve the SIDS of the inbound permissions, and present that data to the operator. Additionally, the logging features of pyldapsearch have been integrated with Aced to log the targeted principal's LDAP attributes locally which...
Erlik : Vulnerable Soap Service
Erlik is a vulnerable SOAP web service. It is a lab environment created for people who want to improve themselves in the field of web penetration testing. Features It contains the following vulnerabilities. -LFI -SQL Injection -Informaion Disclosure -Command Inejction -Brute Force -Deserialization Installation git clone https://github.com/anil-yelken/Vulnerable-Soap-Service cd Vulnerable-Soap-Service sudo pip3 install requirements.txt Usage sudo python3 vulnerable_soap.py Exploiting Vulnerabilities SQL Injection Code:https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/sqli.py Download
Masky : Python Library With CLI Allowing To Remotely Dump Domain User Credentials Via An ADCS
Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope. This tool does not exploit any new vulnerability and does not work by dumping the...
Awesome-Password-Cracking :A Curated List Of Awesome Tools, Research, Papers And Other Projects
.png "Awesome-Password-Cracking :A Curated List Of Awesome Tools, Research, Papers And Other Projects")
Awesome-Password-Cracking is a curated list of awesome tools, research, papers and other projects related to password cracking and password security. Read the guidelines before contributing! In short: List is alphabetically sortedIf in doubt, use awesome-lintIf you think an item shouldn't be here open an issue Books Hash Crack: Password Cracking Manual (v3) - Password Cracking Manual v3 is an expanded reference guide for password recovery (cracking) methods, tools,...
Autodeauth : A Tool Built To Automatically Deauth Local Networks
.png "Autodeauth : A Tool Built To Automatically Deauth Local Networks")
Autodeauth is a tool built to automatically deauth local networks Tested on Raspberry Pi OS and Kali Linux Setup $ chmod +x setup.sh$ sudo ./setup.sh This can be changed by editing /etc/systemd/system/autodeauth.service Enter your WiFi interface to use with the autodeauth service: wlan0 Installed!, you can use sudo autodeauth -h to see available options. Use sudo systemctl start autodeauth...
Toxssin : An XSS Exploitation Command-Line Interface And Payload Generator
.png "Toxssin : An XSS Exploitation Command-Line Interface And Payload Generator")
Toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js). This project started as (and still is) a research-based creative endeavor to explore the exploitability depth that an...
Rekono : Execute Full Pentesting Processes Combining Multiple Hacking Tools Automatically
.png "Rekono : Execute Full Pentesting Processes Combining Multiple Hacking Tools Automatically"){kind=logo}
Rekono combines other hacking tools and its results to execute complete pentesting processes against a target in an automated way. The findings obtained during the executions will be sent to the user via email or Telegram notifications and also can be imported in Defect-Dojo if an advanced vulnerability management is needed. Moreover, Rekono includes a Telegram bot that can be used to...
