Invoke-DNSteal : Simple And Customizable DNS Data Exfiltrator
Invoke-DNSteal is a Simple & Customizable DNS Data Exfiltrator. This tool helps you to exfiltrate data through DNS protocol over UDP and TCP, and lets you control the size of queries using random delay. Also, allows you to avoid detections by using random domains in each of your queries and you can use it to transfer information both locally and remotely. Requirements Powershell...
Gorsair : Hacks Its Way Into Remote Docker Containers That Expose Their APIs
Gorsair is a penetration testing tool for discovering and remotely accessing Docker APIs from vulnerable Docker containers. Once it has access to the docker daemon, you can use Gorsair to directly execute commands on remote containers. Exposing the docker API on the internet is a tremendous risk, as it can let malicious agents get information on all of the other...
Red-Shadow : Lightspin AWS IAM Vulnerability Scanner
Red-Shadow is a tool for Lightspin AWS IAM Vulnerability Scanner. Scan your AWS IAM Configuration for shadow admins in AWS IAM based on misconfigured deny policies not affecting users in groups discovered by Lightspin's Security Research Team. The tool detects the misconfigurations in the following IAM Objects: Managed PoliciesUsers Inline PoliciesGroups Inline PoliciesRoles Inline Policies Research Summary AWS IAM evaluation logic for deny policies...
Forblaze : A Python Mac Steganography Payload Generator
Forblaze is a project designed to provide steganography capabilities to Mac OS payloads. Using python3, it will build an Obj-C file for you which will be compiled to pull desired encrypted URLs out of the stego file, fetch payloads over https, and execute them directly into memory. It utilizes custom encryption - it is not cryptographically secure, but purely...
S3-Account-Search : S3 Account Search
S3-Account-Search tool lets you find the account id an S3 bucket belongs too. For this to work you need to have at least one of these permissions: Permission to download a known file from the bucket (s3:getObject).Permission to list the contents of the bucket (s3:ListBucket). Additionally, you will need a role that you can assume with (one of) these permissions on the...
WAF-A-MoLE : A Guided Mutation-Based Fuzzer For ML-based Web Application Firewalls
WAF-A-MoLE is a guided mutation-based fuzzer for ML-based Web Application Firewalls, inspired by AFL and based on the FuzzingBook by Andreas Zeller et al. Given an input SQL injection query, it tries to produce a semantic invariant query that is able to bypass the target WAF. You can use this tool for assessing the robustness of your product by letting WAF-A-MoLE explore the solution space to...
AWS Pen-Testing Laboratory : Pentesting Lab With A Kali Linux Instance Accessible Via Ssh And Wireguard VPN And With Vulnerable Instances In A Private Subnet
AWS Pen-Testing Laboratory deployed as IaC with Terraform on AWS. It deploys a Kali Linux instance accessible via ssh & wire guard VPN. Vulnerable instances in a private subnet. NOTE: Ids only defined for region "eu-west-1"For other regions, kali ami id must be specified and metasploitable3 id (after building it) Changelog AMI IDs changed to use Kali 2021.2 Use new Kali version...
Heappy : A Happy Heap Editor To Support Your Exploitation Process
Heappy is an editor based on gdb/gef that helps you to handle the heap during your exploitation development.The project should be considered a didactic tool useful to understand the evolution of the heap during the process life cycle. It has been created to simplify the study of the most common heap exploitation techniques and to support you to solve...
Fully-Homomorphic-Encryption : Libraries And Tools To Perform Fully Homomorphic Encryption Operations On An Encrypted Data Set
Fully-Homomorphic-Encryption, this repository contains open-source libraries and tools to perform fully homomorphic encryption (FHE) operations on an encrypted data set. About Fully Homomorphic Encryption Fully Homomorphic Encryption (FHE) is an emerging data processing paradigm that allows developers to perform transformations on encrypted data. FHE can change the way computations are performed by preserving privacy end-to-end, thereby giving users even greater confidence...
RomBuster : A Router Exploitation Tool That Allows To Disclosure Network Router Admin Password
RomBuster is a router exploitation tool that allows to disclosure network router admin password. Features Exploits vulnerabilities in most popular routers such as D-Link, Zyxel, TP-Link and Huawei.Optimized to exploit multiple routers at one time from list.Simple CLI and API usage. Installation pip3 install git+https://github.com/EntySec/RomBuster Basic Usage To use RomBuster just type rombuster in your terminal. usage: rombuster RomBuster is a router exploitation tool that allows to disclosure...
