Dontgo403 : Tool To Bypass 40X Response Codes
Dontgo403 is a tool to bypass 40X error. Installation git clone https://github.com/devploit/dontgo403; cd dontgo403; go get; go build Customization If you want to edit or add new bypasses, you can add it directly to the specific file in payloads folder and the tool will use it. Options ./dontgo403 -hCommand line application that automates different ways to bypass 40X codes.Usage:dontgo403 Flags:-b, --bypassIp string Try bypass tests with a...
VulnLab : A Web Vulnerability Lab Project
VulnLab is a web vulnerability lab project developed by Yavuzlar. Vulnerabilities SQL InjectionCross Site Scripting (XSS)Command InjectionInsecure Direct Object References (IDOR)Cross Site Request Forgery (CSRF)XML External Entity (XXE)Insecure DeserializationFile UploadFile InclusionBroken Authentication Installation Install with DockerHub If you want to install on DockerHub, just type this command docker run --name vulnlab -d -p 1337:80 yavuzlar/vulnlab:latest Go to http://localhost:1337 Manuel Installation Clone the repo git clone https://github.com/Yavuzlar/VulnLab Build docker image docker build -t...
Http2Smugl : Tool to detect and exploit HTTP request smuggling
Http2Smugl tool helps to detect and exploit HTTP request smuggling in cases it can be achieved via HTTP/2 -> HTTP/1.1 conversion by the frontend server. The scheme is as follows: An attacker sends a crafted HTTP/2 request to the target server, which we call frontend.The request is (presumably) converted to HTTP/1.1 and transmitted to another, backend server. The attacker wants to find such a request...
Whatfiles : Log What Files Are Accessed By Any Linux Process
Whatfiles is a Linux utility that logs what files another program reads/writes/creates/deletes on your system. It traces any new processes and threads that are created by the targeted process as well. Rationale I've long been frustrated at the lack of a simple utility to see which files a process touches from main() to exit. Whether you don't trust a software vendor or are...
Second-Order : Subdomain Takeover Scanner
Second-Order is a Scans web applications for second-order subdomain takeover by crawling the app, and collecting URLs (and other data) that match certain rules, or respond in a certain way. Installation From binary Download a prebuilt binary from the releases page and unzip it. From source Go version 1.17 is recommended go install -v github.com/mhmdiaa/second-order@latest Docker docker pull mhmdiaa/second-order Command line options -target stringTarget URL-config stringConfiguration file (default "config.json")-depth intDepth to...
Mandiant-Azure-AD-Investigator : PowerShell module for detecting artifacts
Mandiant-Azure-AD-Investigator repository contains a PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity. Some indicators are "high-fidelity" indicators of compromise, while other artifacts are so called "dual-use" artifacts. Dual-use artifacts may be related to threat actor activity, but also may be related to legitimate functionality. Analysis and verification will be required for...
Pwndora : Massive IPv4 Scanner, Find And Analyze Internet-Connected Devices In Minutes
Pwndora is a massive and fast IPv4 address range scanner, integrated with multi-threading. Using sockets, it analyzes which ports are open, and collects more information about targets. This project allows users to create their own IoT search engine at home, in simple steps, for educational purposes. Features Port scanning with different options and retrieve software banner information.Detect some web technologies and operating...
T-Reqs-HTTP-Fuzzer : A Grammar-Based HTTP Fuzzer
T-Reqs-HTTP-Fuzzer (Two Requests) is a grammar-based HTTP Fuzzer written as a part of the paper titled "T-Reqs: HTTP Request Smuggling with Differential Fuzzing" which was presented at ACM CCS 2021. T-Reqs is for fuzzing HTTP servers by sending mutated HTTP requests with versions 1.1 and earlier. It has three main components: 1) generating inputs, 2) mutating generated inputs and 3) delivering them to the...
Wireshark-Forensics-Plugin : A cross-platform Wireshark plugin that correlates network traffic data
Wireshark-Forensics-Plugin is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it does not provide any contextual information about network endpoints. For a typical analyst, who has to comb through GBs of PCAP...
Dep-Scan : Fully Open-Source Security Audit For Project Dependencies
dep-scan is a fully open-source security audit tool for project dependencies based on known vulnerabilities, advisories and license limitations. Both local repositories and container images are supported as input. The tool is ideal for CI environments with built-in build breaker logic. If you have just come across this repo, probably the best place to start is to checkout the parent...
